feat/Update_Controllers_to_Allow_for_Premium_Membership

deploy/first-production-deployment.md

@@ -49,8 +49,10 @@ Verified by reading `deploy/deploy.sh` and `JobTrackerApi/Program.cs`:
       - `AI_SERVICE_TOKEN` — compose refuses to start without it
       - `AUTH_JWT_KEY` — with `Auth__Require=true`, a blank key **throws at startup** (this is good;
         it fails loud rather than silently invalidating every session on restart)
-      - `APP_PUBLIC_BASE_URL` — optional; without it the post-deploy public smoke check is skipped,
-        and the script prints that it is skipping
+      - `APP_PUBLIC_BASE_URL` — required canonical HTTPS origin with no path, query, fragment or
+        credentials; it controls generated links, OAuth callbacks, secure cookies and Host validation
+      - `WEB_PROXY_SUBNET` — required dedicated IPv4 CIDR for nginx-to-backend traffic; confirm it
+        does not overlap any existing Docker network before deployment
       - `AUTH_ADMIN_EMAIL` / `AUTH_ADMIN_PASSWORD` only if you want admin seeding on this boot
 - [ ] **Connection string host resolves from inside the container.** `Server=127.0.0.1` means *the
       backend container*, not the host — this bit me during validation. Use the host's LAN address, a