Correct stale deploy docs and document the new env knobs

deploy/README.md described a rewrites() block that no longer exists, and told
the reader to verify the image bucket's anonymous-download policy was set -
which is precisely the exposure that was closed. Following it would have
re-opened every stored image to the public internet.

Replaced with what is actually true: /minio-images is a session-gated route
handler with per-user key-prefix ownership, the bucket must have no anonymous
policy, and MinIO must stay bound to loopback. Also noted that the suggested
`mc anonymous get` check does not work on this host - the alias has no
credentials and returns Access Denied either way - and gave an external curl
that actually tells you something.

The same stale rationale sat in deploy.sh's build comment. Building without the
env file is still right, just for a different reason: nothing needs baking in.

Added the MCP and OAuth journal greps, an unauthenticated discovery check, and
a note that a 307 there means /.well-known fell out of PUBLIC_ROUTES. Documented
in .env.example that NEXTAUTH_URL must be the exact public origin with no
trailing slash, since it is now the OAuth issuer and MCP resource identifier,
plus the MCP_CHATGPT_TOOLS opt-out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1Ee4Mc1X1SX8HgYa52zu7

deploy/deploy.sh

@@ -109,9 +109,10 @@ git -C "$APP_DIR/repo" log --oneline -1
 
 cd "$APP_DIR/repo"
 export npm_config_cache="$APP_DIR/.npm" NODE_OPTIONS=--max-old-space-size=3072
-# Built WITHOUT the env file, deliberately - same as the Dockerfile. next.config.mjs
-# evaluates rewrites() at build time, so sourcing the env here would bake a different
-# /minio-images destination into routes-manifest.json.
+# Built WITHOUT the env file, deliberately - same as the Dockerfile. Every setting
+# this app reads (NEXTAUTH_URL, MINIO_ENDPOINT, ...) is read at request time by a
+# dynamic route, so nothing needs baking in and the bundle stays host-independent.
+# Keep it that way: a build that depends on secrets stops being reproducible.
 npm ci --prefer-offline --no-audit --fund=false
 npx prisma generate
 npm run build