feat: harden the myep OAuth2 login

.env

@@ -18,6 +18,15 @@
 APP_ENV=dev
 APP_SECRET=
 APP_SHARE_DIR=var/share
+
+# The Host headers this application answers to, as a regular expression -- the OAuth2
+# redirect_uri is generated from the incoming request, so an unchecked Host header is what myep
+# is told to send the authorization code to. Empty means every host is accepted; set it per
+# environment, e.g. SYMFONY_TRUSTED_HOSTS='^ephub\.example\.com$'.
+SYMFONY_TRUSTED_HOSTS=
+# Only behind a TLS-terminating proxy: the proxy's address, a comma-separated list, or
+# "private_ranges". Without it the generated redirect_uri of such a deployment comes out http://.
+SYMFONY_TRUSTED_PROXIES=
 ###< symfony/framework-bundle ###
 
 ###> symfony/routing ###
@@ -56,12 +65,11 @@ MAILER_DSN=null://null
 # https://ephub.ddev.site/auth/check for local dev, plus the production host. Leave the id and
 # secret empty until then -- the login page detects it and says so.
 #
-# `email` is the address the account actually signed in with, and it is what the local `user`
-# table is keyed on. It is not myep's account identifier -- that is the opaque, stable `sub`
-# claim, which myep's consumer guide asks consumers to match on. Keying on email here is
-# deliberate, at the price of a myep-side email change reading as a new account, so such a
-# change has to be applied to the `user` table too. Do NOT use profile.communication.email: it
-# is the first contact address on the BusPro record, shared by every account of the same person.
+# The local `user` table is keyed on the `sub` claim -- opaque, stable, and unique per myep
+# account -- so an address change on myep updates the row instead of creating a second one.
+# `email` is the address the session actually signed in with and is kept as a display and
+# contact value. Do NOT use profile.communication.email: it is the first contact address on the
+# BusPro record, shared by every account of the same person.
 EP_OAUTH2_CLIENT_ID=
 EP_OAUTH2_CLIENT_SECRET=
 EP_OAUTH2_URL_AUTHORIZE=https://myep.ddev.site/authorize