Serve /api/ on piha.lc / beta.piha.li (#8)

## Summary
- Serve `/api/` on `piha.lc` / `beta.piha.li` (Bearer still required).
- Drop `shortener.aimloperations.com` / `shortener-beta.aimloperations.com` from env examples and caller docs.
- `/admin/` stays 404 on the public host.

Closes #7.

## Test plan
- [ ] `POST https://beta.piha.li/api/links/` with valid Bearer → 201
- [ ] Same without Bearer → 401
- [ ] `GET https://beta.piha.li/<code>` still 302
- [ ] `/admin/` on beta.piha.li → 404
- [ ] Unit tests: `cd site && uv run python manage.py test`

Reviewed-on: #8

.env.prod.example

@@ -12,8 +12,8 @@
 DJANGO_ENV=prod
 DJANGO_DEBUG=false
 DJANGO_SECRET_KEY=replace-with-a-long-random-secret
-# Public short host AND public API hostname (plus docker names if used).
-DJANGO_ALLOWED_HOSTS=piha.lc,shortener.aimloperations.com,url-shortener,web
+# Public short host (plus docker names if used). One hostname for mint + redirects.
+DJANGO_ALLOWED_HOSTS=piha.lc,url-shortener,web
 
 # Shared external Postgres
 DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/url_shortener
@@ -24,7 +24,7 @@ WEB_PORT=8005
 SHORT_DOMAIN=piha.lc
 PUBLIC_SHORT_URL=https://piha.lc
 SHORT_PUBLIC_HOSTS=piha.lc
-SHORT_API_HOSTS=shortener.aimloperations.com,url-shortener,web
+SHORT_API_HOSTS=piha.lc,url-shortener,web
 SHORT_ADMIN_HOSTS=localhost,127.0.0.1
 # Generate: python -c "import secrets; print(secrets.token_urlsafe(32))"
 # This token is the only thing that authorizes minting. Treat it as a secret.
@@ -45,11 +45,13 @@ GUNICORN_BIND=0.0.0.0:8000
 # DJANGO_ENV=beta
 # DJANGO_DEBUG=false
 # DJANGO_SECRET_KEY=replace-with-a-different-beta-secret
-# DJANGO_ALLOWED_HOSTS=beta.piha.li,shortener-beta.aimloperations.com,url-shortener,web
+# DJANGO_ALLOWED_HOSTS=beta.piha.li,url-shortener,web
 # DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/url_shortener_beta
 # WEB_PORT=8015
 # SHORT_DOMAIN=beta.piha.li
 # PUBLIC_SHORT_URL=https://beta.piha.li
 # SHORT_PUBLIC_HOSTS=beta.piha.li
+# SHORT_API_HOSTS=beta.piha.li,url-shortener,web
+# SHORT_ADMIN_HOSTS=localhost,127.0.0.1
 # SHORTENER_API_TOKENS=monica:replace-with-a-different-token
 # CLICK_IP_PEPPER=replace-with-a-different-pepper