Default WEBHOOKER_ENVIRONMENT to prod (closes #307)

An unset WEBHOOKER_ENVIRONMENT now means prod, not dev. The only
thing dev still changes is CORS, which then answers every origin with
Access-Control-Allow-Origin: *, so an operator who forgets the
variable is no longer silently permissive; dev must be set
explicitly. Cookie Secure and CSRF strictness follow each request's
transport and are unaffected.

The README, comments and tests no longer describe dev as the default:
the deployment checklist asks only that the environment is not dev,
the Docker and nginx examples drop the now-redundant setting, and the
TRUSTED_PROXIES warning gives its real reason for firing in every
environment.

Model: opus-4-8 (implementation); opus-5-5 (rework)

README.md

@@ -44,9 +44,9 @@ make bootstrap
 # Run all checks (test, lint, format check)
 make check
 
-# Run in development mode. DATA_DIR defaults to /var/lib/webhooker in
-# every environment, so set it (in .env or the shell) to a writable
-# directory when running from a clone.
+# Run the server from the clone. DATA_DIR defaults to
+# /var/lib/webhooker in every environment, so set it (in .env or the
+# shell) to a writable directory.
 DATA_DIR=./data make dev
 
 # Build Docker image
@@ -92,7 +92,8 @@ them at once. A variable already present in the real environment wins
 over the file's value for the same name.
 
 The environment is selected by setting `WEBHOOKER_ENVIRONMENT` to `dev`
-or `prod` (default: `dev`). The setting controls exactly one behavior:
+or `prod` (default: `prod`; `dev` must be set explicitly). The setting
+controls exactly one behavior:
 
 | Behavior | `dev`                   | `prod`           |
 | -------- | ----------------------- | ---------------- |
@@ -134,7 +135,7 @@ TTY detection, and security headers are always applied.
 
 | Variable                | Description                         | Default  |
 | ----------------------- | ----------------------------------- | -------- |
-| `WEBHOOKER_ENVIRONMENT` | `dev` or `prod`                     | `dev`    |
+| `WEBHOOKER_ENVIRONMENT` | `dev` or `prod`                     | `prod`   |
 | `PORT`                  | HTTP listen port                    | `8080`   |
 | `BIND_ADDRESS`          | IP address the HTTP listener binds. Loopback by default, so the cleartext listener is not published on every interface. The Docker image ships `0.0.0.0` instead. See [Bind address](#bind-address) | `127.0.0.1` (image: `0.0.0.0`) |
 | `DATA_DIR`              | Directory for all SQLite databases  | `/var/lib/webhooker` |
@@ -399,10 +400,9 @@ the bucket is. See [Rate Limiting](#rate-limiting).
 
 The remedy is to set `TRUSTED_PROXIES` to your reverse proxy's
 address, which restores per-client buckets. webhooker logs a warning
-at startup whenever `TRUSTED_PROXIES` is empty, in every environment —
-not only when `WEBHOOKER_ENVIRONMENT=prod`, because that variable
-defaults to `dev` and an operator who never set it is precisely the
-one at risk. The warning is informational when nothing proxies to the
+at startup whenever `TRUSTED_PROXIES` is empty, in every environment,
+because behind a proxy every client shares one bucket in `dev` and
+`prod` alike. The warning is informational when nothing proxies to the
 process: with no proxy in front, the peer address is the client's own
 and the buckets are already per-client. See
 [Rate Limiting](#rate-limiting) for what each limit shares.
@@ -638,7 +638,6 @@ decision:
 docker run -d \
   -p 127.0.0.1:8080:8080 \
   -v /path/to/data:/var/lib/webhooker \
-  -e WEBHOOKER_ENVIRONMENT=prod \
   -e BIND_ADDRESS=0.0.0.0 \
   webhooker:latest
 ```
@@ -812,17 +811,18 @@ reports.
    serves the admin login form and the unauthenticated receiver with
    no TLS at all, and the proxy in front of it changes nothing about
    that.
-2. **Set `WEBHOOKER_ENVIRONMENT=prod`, and make sure the proxy sends
-   `X-Forwarded-Proto`.** These are two requirements, not one. The
-   environment setting decides CORS and nothing else: the default
+2. **Make sure the environment is not `dev` (leave
+   `WEBHOOKER_ENVIRONMENT` unset or set it to `prod`), and make sure
+   the proxy sends `X-Forwarded-Proto`.** These are two requirements,
+   not one. The environment setting decides CORS and nothing else:
    `dev` answers every origin with `Access-Control-Allow-Origin: *`
    (without credentials), which a server-rendered production
-   deployment has no use for. Cookie `Secure` and the strict
-   Origin/Referer mode are **not** tied to it — they are decided per
-   request from the transport, which behind a proxy means the
-   `X-Forwarded-Proto` header. The block below sets it; without it
-   every request is read as plaintext and cookies ship without
-   `Secure`. See [Configuration](#configuration).
+   deployment has no use for, and `prod` — the default — disables it.
+   Cookie `Secure` and the strict Origin/Referer mode are **not** tied
+   to it — they are decided per request from the transport, which
+   behind a proxy means the `X-Forwarded-Proto` header. The block below
+   sets it; without it every request is read as plaintext and cookies
+   ship without `Secure`. See [Configuration](#configuration).
 3. **Set `TRUSTED_PROXIES` to the proxy's address.** Unset, every rate
    limiter keys on the connecting peer, which behind a proxy is the
    proxy on every request: all clients collapse into one global bucket
@@ -914,7 +914,6 @@ sent — `$scheme` above does.
 With that block, webhooker's environment is:
 
 ```sh
-WEBHOOKER_ENVIRONMENT=prod
 BIND_ADDRESS=127.0.0.1   # the default; stated here to be explicit
 TRUSTED_PROXIES=127.0.0.1
 ```