Self-host: every link points at the install, never at coderhelm.com - #312

Summary

A self-hosted install never sends people to coderhelm.com for anything that belongs to the install. Emails, Slack and Teams cards, GitHub comments, redirects and support all use the install's own address and inbox; coderhelm.com is only for the hosted service and its public docs. If the install doesn't know its own address, it now says so (an error at start and a failing Web address answers setup check) instead of quietly linking to app.coderhelm.com. Paired with the dashboard PR CoderHelm/coderhelm#227.

Changes

Fixed (links that belong to the install)

• Agent approvals: the Slack and Teams buttons, approval emails and the approval link page used hardcoded app.coderhelm.com and api.coderhelm.com. They now use app_url and api_url.
• public_urls: on a self-hosted install (SELF_HOSTED=1, now set by the deploy, or the setup endpoints, SSM URL parameter or release stamp that only a self-hosted install has), app_url and api_url never fall back to the hosted addresses. Until the address is known, links are relative, the services log an error at start, and the Web address answers check fails and says what is missing.
• Log analyzer: the Teams and Slack cards defaulted to app.coderhelm.com. DASHBOARD_URL is now required (the deploy always sets it).
• MCP dynamic registration sent client_uri: https://coderhelm.com. It now sends the install's own origin.
• /openapi.json served by a self-hosted install named api.coderhelm.com as its server. It now names the install's API; the committed document is unchanged.
• The worker's "GitHub App is not installed" error linked to the hosted app. It now links to the install's GitHub settings.
• New GET /auth/github/app: redirects to this deployment's own GitHub App (a new installation with state, or an installation's settings). The dashboard's GitHub App buttons use it.

Fixed (support and admin)

• The weekly summary's mailto unsubscribe and support ticket emails fell back to support@coderhelm.com. On a self-hosted install they use SUPPORT_INBOX, else SES_FROM_ADDRESS.
• PLATFORM_ADMIN_EMAILS fell back to the hosted admin. On a self-hosted install it falls back to nobody.
• Email footers fell back to coderhelm.com when SITE_URL was unset. On a self-hosted install they show no site.

Guards

• Render tests, as an install at https://coderhelm.example.com: approval cards (Slack and Teams) and links, sign-in prompts, plugin review cards and approval links, knowledge sign-in cards and emails, alert and log fix cards, merge-gate controls, the CI quarantine call, unsubscribe links and pages, support emails, the weekly summary for every role, issue progress comments and the consulted-agents line in PRs. Any coderhelm.com host other than docs.coderhelm.com fails.
• services/common/tests/no_hosted_urls.rs scans services, lambdas, infra and the installer and fails on new app., api., stream. or auth.coderhelm.com (or the marketing site) outside an allowlist, each entry with its reason.
• Infra: every self-hosted service gets SELF_HOSTED=1; the hosted gateway doesn't.

Docs

• docs/self-host/email.md: what links, logos and support addresses a self-hosted install uses. docs/self-host/config-reference.md: SELF_HOSTED.

Kept on purpose: hybrid's hosted API URL and the hosted-side {name}.coderhelm.com fallback page; the committed OpenAPI document; the knowledge-sync User-Agent; the opt-in installer telemetry endpoint; docs.coderhelm.com links. The Jira Forge app (coderhelm-jira) is hosted-only and still names the hosted dashboard; it is listed in the audit, not changed here.

Verification

• cargo fmt --check, cargo clippy --workspace --all-targets -D warnings: clean.
• cargo test --workspace: 2140 passed, 16 ignored (after rebasing onto main).
• The lint test fails when a hosted address is planted in lambda/log-analyzer/handler.py, then passes once it is removed.
• python3 -m unittest discover -s lambda/tests: 105 passed.
• infra: npm test 59 passed, including the new SELF_HOSTED assertions.