Support separate public forms domain

.env.example

@@ -7,6 +7,8 @@ POSTGRES_PASSWORD="change-this"
 AUTH_SECRET="change-me"
 # Public origin of the app (no trailing slash).
 AUTH_URL="https://forms.example.com"
+# Public origin used for published form, share, and embed links.
+PUBLIC_FORM_URL="https://forms-public.example.com"
 
 # --- Authentik OIDC ---
 # In Authentik: Applications → Providers → Create → OAuth2/OpenID
@@ -26,8 +28,8 @@ RATE_LIMIT_DRIVER="memory"
 # REDIS_URL="redis://localhost:6379"
 
 # --- Notifications ---
-# Defaults to AUTH_URL in docker-compose.yml.
-PUBLIC_BASE_URL="https://forms.example.com"
+# Admin origin used for response links in notifications. Defaults to AUTH_URL.
+# PUBLIC_BASE_URL="https://forms.example.com"
 # Email driver: resend | smtp | none
 EMAIL_DRIVER="none"
 EMAIL_FROM="Forms <[email protected]>"