Serve /api/ on piha.lc / beta.piha.li (#8)

## Summary
- Serve `/api/` on `piha.lc` / `beta.piha.li` (Bearer still required).
- Drop `shortener.aimloperations.com` / `shortener-beta.aimloperations.com` from env examples and caller docs.
- `/admin/` stays 404 on the public host.

Closes #7.

## Test plan
- [ ] `POST https://beta.piha.li/api/links/` with valid Bearer → 201
- [ ] Same without Bearer → 401
- [ ] `GET https://beta.piha.li/<code>` still 302
- [ ] `/admin/` on beta.piha.li → 404
- [ ] Unit tests: `cd site && uv run python manage.py test`

Reviewed-on: #8

.env.example

@@ -18,11 +18,11 @@ CONTACT_URL=https://aimloperations.com/contact
 SHORT_DOMAIN=localhost:8005
 # Origin printed in minted short_url (phones hit this). Local: this machine.
 PUBLIC_SHORT_URL=http://127.0.0.1:8005
-# Host values that only serve GET /<code> (no /api/).
+# Host values that serve GET /<code> and /api/ (Bearer). Same public hostname.
 SHORT_PUBLIC_HOSTS=piha.lc
-# Host values that serve /api/ (Bearer required). May include a public DNS name.
+# Extra Host values that also serve /api/ (localhost / docker).
 SHORT_API_HOSTS=localhost,127.0.0.1,0.0.0.0,web,url-shortener
-# Django admin — keep local. Do not add the public API hostname.
+# Django admin — keep local. Do not add the public short hostname.
 SHORT_ADMIN_HOSTS=localhost,127.0.0.1
 # Named, rotatable tokens. This is what keeps /api/ closed on a public hostname.
 # Generate: python -c "import secrets; print(secrets.token_urlsafe(32))"