Generate env.local at runtime so secrets such as APP_SECRET can be provided outside the Nix store.
Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)
Move mutable public media and uploads out of the Nix store and add nginx hardening for served media files.
Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)