piha.lc / beta.piha.li + company_site marketing landing (#4)

## Summary

- Public short domain is **`piha.lc`** (prod) and **`beta.piha.li`** (beta)
- `/` is a marketing page in [aimloperations.com](https://aimloperations.com) / `company_site` styling (Inter, dark, cyan)
- CTA: want access → [contact](https://aimloperations.com/contact)
- Nav/logo/footer match the company site; debug mint form uses the same chrome

Closes #3.

## Secrets (control node)

Update hostnames only — no new token/pepper unless you are rotating:

**`url_shortening_service_prod.env`**
```text
DJANGO_ALLOWED_HOSTS=piha.lc,shortener.aimloperations.com,url-shortener,web
SHORT_DOMAIN=piha.lc
PUBLIC_SHORT_URL=https://piha.lc
SHORT_PUBLIC_HOSTS=piha.lc
CONTACT_URL=https://aimloperations.com/contact
```

**`url_shortening_service_beta.env`**
```text
DJANGO_ALLOWED_HOSTS=beta.piha.li,shortener-beta.aimloperations.com,url-shortener,web
SHORT_DOMAIN=beta.piha.li
PUBLIC_SHORT_URL=https://beta.piha.li
SHORT_PUBLIC_HOSTS=beta.piha.li
CONTACT_URL=https://aimloperations.com/contact
```

NPM: `piha.lc` / `beta.piha.li` → this container. Still do not proxy `/api/` on the short host.

## Test plan
- [ ] `cd site && uv run python manage.py test`
- [ ] `GET /` looks like aimloperations.com; Request access / Contact go to aimloperations.com/contact
- [ ] `GET /<code>` still 302
- [ ] `/api/` on Host `piha.lc` is 404

Reviewed-on: #4

.env.prod.example

@@ -13,7 +13,7 @@ DJANGO_ENV=prod
 DJANGO_DEBUG=false
 DJANGO_SECRET_KEY=replace-with-a-long-random-secret
 # Public short host AND public API hostname (plus docker names if used).
-DJANGO_ALLOWED_HOSTS=go.mkdrealtor.com,shortener.aimloperations.com,url-shortener,web
+DJANGO_ALLOWED_HOSTS=piha.lc,shortener.aimloperations.com,url-shortener,web
 
 # Shared external Postgres
 DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/url_shortener
@@ -21,18 +21,19 @@ DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/url_shorten
 # Host port (must match server-infra). NPM proxies SHORT_DOMAIN here.
 WEB_PORT=8005
 
-SHORT_DOMAIN=go.mkdrealtor.com
-PUBLIC_SHORT_URL=https://go.mkdrealtor.com
-SHORT_PUBLIC_HOSTS=go.mkdrealtor.com
+SHORT_DOMAIN=piha.lc
+PUBLIC_SHORT_URL=https://piha.lc
+SHORT_PUBLIC_HOSTS=piha.lc
 SHORT_API_HOSTS=shortener.aimloperations.com,url-shortener,web
 SHORT_ADMIN_HOSTS=localhost,127.0.0.1
 # Generate: python -c "import secrets; print(secrets.token_urlsafe(32))"
 # This token is the only thing that authorizes minting. Treat it as a secret.
 # monica_site sends: Authorization: Bearer monica:<same-secret>
 SHORTENER_API_TOKENS=monica:replace-with-token-urlsafe-32
-SHORT_ALLOWED_HOSTS=mkdrealtor.com
+SHORT_ALLOWED_HOSTS=mkdrealtor.com,aimloperations.com
 SHORT_CODE_LENGTH=6
 CLICK_IP_PEPPER=replace-with-a-distinct-pepper
+CONTACT_URL=https://aimloperations.com/contact
 
 GUNICORN_WORKERS=2
 GUNICORN_BIND=0.0.0.0:8000
@@ -44,11 +45,11 @@ GUNICORN_BIND=0.0.0.0:8000
 # DJANGO_ENV=beta
 # DJANGO_DEBUG=false
 # DJANGO_SECRET_KEY=replace-with-a-different-beta-secret
-# DJANGO_ALLOWED_HOSTS=go-beta.example.com,shortener-beta.aimloperations.com,url-shortener,web
+# DJANGO_ALLOWED_HOSTS=beta.piha.li,shortener-beta.aimloperations.com,url-shortener,web
 # DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/url_shortener_beta
 # WEB_PORT=8015
-# SHORT_DOMAIN=go-beta.example.com
-# PUBLIC_SHORT_URL=https://go-beta.example.com
-# SHORT_PUBLIC_HOSTS=go-beta.example.com
+# SHORT_DOMAIN=beta.piha.li
+# PUBLIC_SHORT_URL=https://beta.piha.li
+# SHORT_PUBLIC_HOSTS=beta.piha.li
 # SHORTENER_API_TOKENS=monica:replace-with-a-different-token
 # CLICK_IP_PEPPER=replace-with-a-different-pepper