docs: plan HTTPS peers and source install

docs/web-console-and-observability.md

@@ -27,8 +27,9 @@ absolute lifetime. State-changing browser requests require CSRF validation.
 Authenticated responses use no-store and restrictive security headers.
 
 OAuth/device authorization is not implemented. Public exposure requires a TLS
-reverse proxy and network restrictions. Do not claim that `WORKER_URL` enables
-TLS; it only advertises the externally reachable URL.
+reverse proxy and network restrictions. The accepted target name is
+`PUBLIC_URL`; `WORKER_URL` is current legacy configuration during migration.
+Neither setting enables TLS; it only advertises the externally reachable URL.
 
 ## Known Runtime Gap