Document clearnet, TLS, and Tor setup; enable Nest CORS only in development and skip CORS_ORIGINS validation in production.
Prod deploy, cert bootstrap/issue/renew, and onion hostname helper for docker-compose.prod.