Serve /api/ on piha.lc / beta.piha.li (#8)

## Summary
- Serve `/api/` on `piha.lc` / `beta.piha.li` (Bearer still required).
- Drop `shortener.aimloperations.com` / `shortener-beta.aimloperations.com` from env examples and caller docs.
- `/admin/` stays 404 on the public host.

Closes #7.

## Test plan
- [ ] `POST https://beta.piha.li/api/links/` with valid Bearer → 201
- [ ] Same without Bearer → 401
- [ ] `GET https://beta.piha.li/<code>` still 302
- [ ] `/admin/` on beta.piha.li → 404
- [ ] Unit tests: `cd site && uv run python manage.py test`

Reviewed-on: #8

API.md

@@ -2,14 +2,13 @@
 
 For other services (`monica_site`, later callers) that mint short links.
 
-This service has two public hostnames. **Call the API host.** Never create links
-on the short domain (`piha.lc` / `beta.piha.li`). That host
-only serves `GET /` (landing) and `GET /<code>` (302). `/api/` there is **404**.
+This service has one public hostname. Call it for minting **and** for
+redirects. Prod: `https://piha.lc`. Beta: `https://beta.piha.li`.
 
 | Host | Example | What you call |
 |------|---------|----------------|
-| API | `https://shortener.aimloperations.com` | `POST/GET /api/links/` |
-| Short | `https://piha.lc` (beta: `https://beta.piha.li`) | phones only — `GET /<code>` |
+| Prod | `https://piha.lc` | `POST /api/links/` and `GET /<code>` |
+| Beta | `https://beta.piha.li` | same |
 
 Local compose: API + redirects on `http://127.0.0.1:8005`.
 
@@ -53,7 +52,7 @@ mint without it.
    allows `www.mkdrealtor.com`. `https` only.
 
 5. Give the caller **only**:
-   - API origin (`SHORTENER_BASE_URL`)
+   - Origin (`SHORTENER_BASE_URL` — `https://piha.lc` or `https://beta.piha.li`)
    - The full token string `name:secret` (they send it as Bearer)
 
    Never put the token in git, logs, or the short URL.
@@ -66,11 +65,11 @@ Add to that app’s env (not this repo):
 
 ```text
 # Prod
-SHORTENER_BASE_URL=https://shortener.aimloperations.com
+SHORTENER_BASE_URL=https://piha.lc
 SHORTENER_API_TOKEN=monica:<same-secret>
 
-# Beta (when that host exists)
-# SHORTENER_BASE_URL=https://shortener-beta.aimloperations.com
+# Beta
+# SHORTENER_BASE_URL=https://beta.piha.li
 # SHORTENER_API_TOKEN=monica:<beta-secret>
 
 # Local (this service via compose)
@@ -156,8 +155,8 @@ Content-Type: application/json
 }
 ```
 
-`short_url` is built from this service’s `PUBLIC_SHORT_URL` (the domain phones
-hit). It is **not** the API host. Put `short_url` in SMS / email as-is.
+`short_url` is built from this service’s `PUBLIC_SHORT_URL` (same origin you
+called). Put `short_url` in SMS / email as-is.
 
 ### Idempotency `200`
 
@@ -286,4 +285,4 @@ def shorten(target_url: str, *, title: str = "", external_ref: str = "") -> str:
 ```
 
 Use `short_url` in the message body. On `401`/`503`, fail the send — do not
-fall back to pasting the API host into SMS.
+fall back to pasting a long URL unless that is your explicit fallback.