Serve /api/ on piha.lc / beta.piha.li (#8)

## Summary
- Serve `/api/` on `piha.lc` / `beta.piha.li` (Bearer still required).
- Drop `shortener.aimloperations.com` / `shortener-beta.aimloperations.com` from env examples and caller docs.
- `/admin/` stays 404 on the public host.

Closes #7.

## Test plan
- [ ] `POST https://beta.piha.li/api/links/` with valid Bearer → 201
- [ ] Same without Bearer → 401
- [ ] `GET https://beta.piha.li/<code>` still 302
- [ ] `/admin/` on beta.piha.li → 404
- [ ] Unit tests: `cd site && uv run python manage.py test`

Reviewed-on: #8

README.md

@@ -1,8 +1,9 @@
 # url_shortening_service
 
 Django 6 URL shortener. `monica_site` (and other trusted callers) mint links over
-Bearer auth on an **API hostname** (may be public DNS). SMS recipients hit
-`GET /<code>` on the **short** domain and get a 302 to the long HTTPS URL.
+Bearer auth on the **same** public host phones use. SMS recipients hit
+`GET /<code>` on `piha.lc` (prod) / `beta.piha.li` (beta) and get a 302 to the
+long HTTPS URL.
 
 This service is standalone. Do not fold it into `monica_site`.
 
@@ -10,17 +11,16 @@ This service is standalone. Do not fold it into `monica_site`.
 
 | Who | Path | Auth | Host |
 |-----|------|------|------|
-| Phone / public internet | `GET /<code>` | none | `SHORT_DOMAIN` (NPM + TLS) |
-| Anyone | `GET /` | none | landing page on the short domain |
-| `monica_site` | `/api/links/` | `Authorization: Bearer name:secret` | own DNS / NPM host — **not** the short domain |
+| Phone / public internet | `GET /<code>` | none | `SHORT_DOMAIN` (`piha.lc` / `beta.piha.li`) |
+| Anyone | `GET /` | none | landing page on that same host |
+| `monica_site` | `/api/links/` | `Authorization: Bearer name:secret` | same host |
 
-The API may be on the public internet. It is not open: every `/api/` request needs a
+`/api/` is on the public internet. It is not open: every `/api/` request needs a
 named Bearer token. No token / wrong token → **401**. No tokens configured → **503**.
 `GET /<code>` never requires a token.
 
-`/api/` and `/admin/` are 404 on the short domain. `/admin/` is also 404 on the
-public API hostname (localhost only). `GET /debug/` is a mint form when
-`DEBUG=true` and never on the short domain.
+`/admin/` is 404 on the public host (localhost only). `GET /debug/` is a mint form
+when `DEBUG=true` and never on the public short host.
 
 ## Local run
 
@@ -63,11 +63,11 @@ Deploy calls `server-infra/scripts/deploy.sh --app url_shortening_service`. Need
 ## Use case
 
 1. Your site POSTs to this service with a Bearer token and a long HTTPS URL.
-2. Response `201` includes `short_url` built from `PUBLIC_SHORT_URL` (not the API Host).
+2. Response `201` includes `short_url` built from `PUBLIC_SHORT_URL`.
 3. A person on the public internet opens that short URL.
 4. This service 302s them to the long URL and increments `click_count`.
 
-Mint (API host / localhost):
+Mint (same host / localhost):
 
 ```bash
 curl -sS -X POST http://127.0.0.1:8005/api/links/ \
@@ -89,7 +89,7 @@ Caller integration (onboard + `/api/links/`): **[API.md](API.md)**.
 ## Caller contract (`monica_site`, other repo)
 
 ```text
-SHORTENER_BASE_URL=https://shortener.aimloperations.com
+SHORTENER_BASE_URL=https://piha.lc
 SHORTENER_API_TOKEN=monica:<same-secret-as-SHORTENER_API_TOKENS>
 ```
 
@@ -105,7 +105,7 @@ Content-Type: application/json
 (exact or suffix, e.g. `mkdrealtor.com`). Same `target_url` + `external_ref` +
 still-active link returns `200` with the existing row instead of a new code.
 
-Do not call the public short hostname to create links.
+Do not put the Bearer token on `GET /<code>`.
 
 ## Environment
 
@@ -123,9 +123,9 @@ short URL, logs, or git.
 
 ## Deploy notes
 
-Two NPM hosts, same container `WEB_PORT` (default 8005 prod / 8015 beta):
+One NPM host, container `WEB_PORT` (default 8005 prod / 8015 beta):
 
-1. `SHORT_DOMAIN` (`piha.lc` prod / `beta.piha.li` beta) — `/` landing + `GET /[a-z0-9]{4,8}`.
-   Drop `/api/`, `/admin/`, `/debug/`.
-2. API hostname — proxy `/api/` only. Drop `/admin/`. Add that Host to
-   `DJANGO_ALLOWED_HOSTS` and `SHORT_API_HOSTS`.
+1. `SHORT_DOMAIN` (`piha.lc` prod / `beta.piha.li` beta) — `/` landing,
+   `GET /[a-z0-9]{4,8}`, and `/api/` (Bearer). Django 404s `/admin/` and `/debug/`
+   on this host. Add it to `DJANGO_ALLOWED_HOSTS`, `SHORT_PUBLIC_HOSTS`, and
+   `SHORT_API_HOSTS`.