Let Google sign-in trust the port the app actually uses

[krongggggg]

What this changes

When Google sign-in is enabled and TRUSTED_ORIGINS is unset, the API now accepts http://localhost:3010 — the origin start.sh actually serves. The old fallback was port 3000, so a clone that copied .env.example, started the stack, and wired Google OAuth could be rejected for an origin it was never served from.

Deriving the default from BETTER_AUTH_URL would still be wrong: that URL is the API (3001), not the app.

The README no longer warns about a 3000-vs-3010 footgun. docs/configuration.md records the new default. .env.example already set 3010 and is unchanged.

Where it runs

• New state that outlives a request? None.
• What happens on the second replica? Each process reads the same environment. The default is the same on every process.
• Anything serialised? None.
• Anything fanned out to a browser? None.
• New listener, port, or schedule? None.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act.
• New refusals and new failures each write a row. None added.
• Nothing new is trusted from the client that the server can resolve itself.

Proof

• bun run format / format:check — clean
• bun run lint — exit 0
• bun run typecheck — app, server and worker all exit 0
• bun test server/tests/config.test.ts — 19 pass, 0 fail
• bun run build — app, server and worker all exit 0

Test plan

• Enable Google sign-in without setting TRUSTED_ORIGINS, run scripts/start.sh, and confirm the app origin http://localhost:3010 is accepted
• Set TRUSTED_ORIGINS to a custom origin and confirm that still wins over the default