Stop describing dev as the default environment

Comments in reqtls and session, and the README Quick Start and
deployment checklist, still spoke as if an unset WEBHOOKER_ENVIRONMENT
meant dev. The checklist now asks only that the environment is not dev
(unset or prod); the Quick Start describes running from the clone.

Model: opus-5-5

README.md

@@ -44,9 +44,9 @@ make bootstrap
 # Run all checks (test, lint, format check)
 make check
 
-# Run in development mode. DATA_DIR defaults to /var/lib/webhooker in
+# Run the server from the clone. DATA_DIR defaults to
-# every environment, so set it (in .env or the shell) to a writable
+# /var/lib/webhooker in every environment, so set it (in .env or the
-# directory when running from a clone.
+# shell) to a writable directory.
 DATA_DIR=./data make dev
 
 # Build Docker image
@@ -753,17 +753,18 @@ reports.
    serves the admin login form and the unauthenticated receiver with
    no TLS at all, and the proxy in front of it changes nothing about
    that.
-2. **Set `WEBHOOKER_ENVIRONMENT=prod`, and make sure the proxy sends
+2. **Make sure the environment is not `dev` (leave
-   `X-Forwarded-Proto`.** These are two requirements, not one. The
+   `WEBHOOKER_ENVIRONMENT` unset or set it to `prod`), and make sure
-   environment setting decides CORS and nothing else: `dev` answers
+   the proxy sends `X-Forwarded-Proto`.** These are two requirements,
-   every origin with `Access-Control-Allow-Origin: *` (without
+   not one. The environment setting decides CORS and nothing else:
-   credentials), which a server-rendered production deployment has no
+   `dev` answers every origin with `Access-Control-Allow-Origin: *`
-   use for, and `prod` — the default — disables it. Cookie `Secure`
+   (without credentials), which a server-rendered production
-   and the strict Origin/Referer mode are **not** tied to it — they
+   deployment has no use for, and `prod` — the default — disables it.
-   are decided per request from the transport, which behind a proxy
+   Cookie `Secure` and the strict Origin/Referer mode are **not** tied
-   means the `X-Forwarded-Proto` header. The block below sets it;
+   to it — they are decided per request from the transport, which
-   without it every request is read as plaintext and cookies ship
+   behind a proxy means the `X-Forwarded-Proto` header. The block below
-   without `Secure`. See [Configuration](#configuration).
+   sets it; without it every request is read as plaintext and cookies
+   ship without `Secure`. See [Configuration](#configuration).
 3. **Set `TRUSTED_PROXIES` to the proxy's address.** Unset, every rate
    limiter keys on the connecting peer, which behind a proxy is the
    proxy on every request: all clients collapse into one global bucket

internal/reqtls/reqtls.go

@@ -5,7 +5,7 @@
 // several packages, by hand, and the answers disagreed. The session
 // cookie's Secure attribute was decided at startup from the configured
 // environment while the CSRF cookie's was decided per-request, so a
-// deployment behind a TLS proxy in the default environment emitted one
+// deployment behind a TLS proxy in the dev environment emitted one
 // Secure cookie and one non-Secure cookie on the same response.
 // Everything kept working, which is exactly why nobody noticed.
 //

internal/session/session.go

@@ -146,8 +146,8 @@ func newStore(key []byte) *sessions.CookieStore {
 //
 // This is decided per-request, not once at startup. Deciding it at
 // startup from the configured environment is what this replaces, and
-// it got the DEFAULT posture wrong: "dev" is the environment when
+// it got the DEFAULT posture wrong: "dev" was then the environment when
-// WEBHOOKER_ENVIRONMENT is unset, so a deployment terminating TLS at a
+// WEBHOOKER_ENVIRONMENT was unset, so a deployment terminating TLS at a
 // proxy without also setting the environment emitted the
 // authentication cookie with no Secure attribute -- silently, and on
 // the same response as a CSRF cookie that did have one.

internal/session/session_test.go

@@ -990,8 +990,8 @@ func sessionCookieFrom(
 
 // TestSave_SecureFollowsRequestTransport is the regression test for
 // the defect this replaces: Secure was fixed at startup from the
-// configured environment, and "dev" is the environment when
+// configured environment, and "dev" was then the environment when
-// WEBHOOKER_ENVIRONMENT is unset. A deployment behind a TLS proxy in
+// WEBHOOKER_ENVIRONMENT was unset. A deployment behind a TLS proxy in
 // that DEFAULT posture shipped the authentication cookie with no
 // Secure attribute and said nothing about it.
 //