feat(worker): adopt canonical public URL

.env.example

@@ -9,7 +9,10 @@ RSMON_WORKER_IMAGE_DIGEST=replace-with-64-lowercase-hex-digest
 WORKER_HOST=0.0.0.0
 WORKER_PORT=27401
 WORKER_BIND_IP=127.0.0.1
-WORKER_URL=
+# Advertised public origin: absolute http(s) origin (scheme + host, no path).
+# PUBLIC_URL is canonical. Legacy WORKER_URL is still read during the bounded
+# migration but must not be used for new installs.
+PUBLIC_URL=
 WORKER_LOGIN=admin
 WORKER_PASSWORD=replace-with-a-long-random-password