Docker Compose self-host crashes with the documented http://localhost defaults (loginPage must use https in production) #42

The README's Docker Compose quick start fails with the documented local defaults. The api container crash-loops before it reaches checkConfig:

Error: loginPage must use https in production
    at assertPageLocation (@codelitdev/oauth-server-kit/dist/better-auth.js:87:11)
    at createOAuthProviderOptions (@codelitdev/oauth-server-kit/dist/better-auth.js:105:3)
    at Object.<anonymous> (/app/apps/api/dist/auth/better-auth.js:232:61)

Steps to reproduce

1. cp .env.example .env and fill in the secrets. Keep the local defaults, as .env.example says: "For a local installation, keep these defaults". That means API_PUBLIC_URL=http://localhost:5000, WEB_CLIENT=http://localhost:3000 and PROTOCOL=http.
2. docker compose up --build -d
3. docker compose ps shows api restarting; docker compose logs api shows the error above.

Cause

• docker-compose.yml runs the API with NODE_ENV: production.
• apps/api/src/auth/better-auth.ts passes loginPage: ${authBaseUrl}/oauth/login and consentPage: ${authBaseUrl}/oauth/consent to createOAuthProviderOptions, where authBaseUrl is API_PUBLIC_URL.
• assertPageLocation in @codelitdev/oauth-server-kit throws whenever NODE_ENV === "production" and the URL isn't https.
• The README promises a local Compose install at http://localhost:3000, so the docs and the code contradict each other.

Setting both origins to https://... gets the API past this and the stack boots healthy. This was verified while testing #32, but a plain-http local install is not possible today.

Options

1. Support plain-http local installs. Allow http for loopback hosts (localhost, 127.0.0.1, [::1]) in oauth-server-kit's production check, matching how OAuth tooling usually treats loopback. Also check that Better Auth cookies and OAuth redirects work over http there; secure cookies would also block sign-in over plain http.
2. Pass the pages as absolute paths (/api/auth/oauth/login, which assertPageLocation already accepts). Only if Better Auth resolves them against the API origin correctly.
3. Make https a documented requirement: update .env.example and the README, and fail fast with a clear message in checkConfig, or let Compose set NODE_ENV from .env.

Whichever option is chosen, add a check for the docker compose up path to CI or the release checklist, alongside the config test added for #32. Related: #32, #28 (SES self-host guide), #24 (README refresh).