feat: ship agent onboarding runtime

docs/auth-proxy.md

@@ -16,8 +16,8 @@ At the public application domain, route:
 ```caddy
 zopu.example.com {
     handle /api/auth/* {
-        reverse_proxy https://befitting-dalmatian-161.convex.site {
-            header_up Host befitting-dalmatian-161.convex.site
+        reverse_proxy https://joyous-cat-297.convex.site {
+            header_up Host joyous-cat-297.convex.site
         }
     }
 
@@ -51,7 +51,7 @@ npx convex env set SITE_URL 'https://zopu.example.com'
 npx convex env set SITE_URL 'http://100.101.157.28:5173'
 
 # Staging
-npx convex env set SITE_URL 'https://zopu.cheaptricks.puter.wtf'
+npx convex env set SITE_URL 'https://zopu-staging.vercel.app'
 ```
 
 This value is Better Auth's public `baseURL` and `trustedOrigins`. It must be the browser origin because Better Auth writes OAuth state cookies and receives provider callbacks through the same-origin proxy. `CONVEX_SITE_URL` remains the internal Convex HTTP site URL.