fix(setup): print the hub's public URL, not the host the reader typed

The setup pages build commands that get pasted into a terminal on a *different*
machine, but they built them from location.origin. Open the console by LAN IP or
over a tunnel and the enrolment one-liner told the target machine to curl an
address it may not resolve at all.

/docs and /enroll/:token are now served through a template that stamps in
config.baseUrl — PUBLIC_URL where set, the proxied request host otherwise — with
location.origin left as a fallback for the unsubstituted file. The remaining
127.0.0.1 references are the loopback VNC port on the machine being registered,
which is meant to be literal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

public/docs.html

@@ -293,7 +293,11 @@
 
 <script src="/particles.js"></script>
 <script>
-  const origin = location.origin;
+  // Substituted by the server with this hub's public address. These commands run
+  // on a different machine, so location.origin would be wrong whenever the reader
+  // reached this page by IP or over a tunnel. Falls back only if served unmodified.
+  const stamped = '__HUB__';
+  const origin = stamped.indexOf('__') === 0 ? location.origin : stamped;
 
   const commands = {
     'cmd-macos':          `curl -fsSL ${origin}/install.sh?token=TOKEN | sh`,