feat: harden the myep OAuth2 login

.env.dev

@@ -1,4 +1,10 @@
 
 ###> symfony/framework-bundle ###
+# A throwaway for local development, committed on purpose so a fresh checkout boots. The dev
+# environment is never served: .env.dev and .env.test are both excluded from the deploy rsync,
+# and production takes APP_SECRET from its own uncommitted .env.local.
 APP_SECRET=44660e8fcd421376ebe0f7a7d55e179c
 ###< symfony/framework-bundle ###
+
+# ddev serves the application under this name; anything else is refused.
+SYMFONY_TRUSTED_HOSTS='^ephub\.ddev\.site$'