manueljpconde hardens the one-click self-hosting build

manueljpconde went back over the install-it-yourself package for this fork and fixed two things that matter to anyone running it themselves. A high-privilege secret key - the kind that should never leave the server - was being baked into the part of the app that runs in the user's browser, where anyone could have fished it out. That's now gone.

The same pass fixed a quieter trap. The configuration that lets you point the system at a private AI model running on your own hardware worked on Mac and Windows developer machines but silently failed on Linux - which is what most teams actually deploy on. It works there now, alongside a couple of smaller reliability fixes to keep the setup reproducible.