* public-gh/master:
fix(auth): apply effective trusted origins and honor allowed hostnames in public mode
fix(onboard): preserve env-derived secrets defaults and report ignored exposure env in local_trusted mode
fix: parseBooleanFromEnv silently treats common truthy values as false
set `PAPERCLIP_PUBLIC_URL` in compose files
centralize URLs into single canonical URL var