- resolve headless audience against BACKEND_PUBLIC_URL first
- keep forwarded header support for https absolute audiences
- add regression tests for https success and http mismatch rejection
- write BACKEND_PUBLIC_URL into staging workflow env generation
- replace local auth and test-plan references with wiki URLs
- delete duplicated local markdown files now covered by wiki
- keep operational docs pointing to the new wiki pages
