Point vaultwarden's DOMAIN at APP_URL so it starts without a domain

Found by installing vaultwarden and one instance end to end. The template built
DOMAIN as https://<subdomain>, and blanking host_setup on a box with no
CFG_DOMAIN_n set (earlier in this branch) left it as a bare "https://".
Vaultwarden validates that value and exits:

  Error validating domain: empty host
  DOMAIN variable needs to contain the protocol (http, https)

APP_URL is already the address the app is reached at in both worlds —
https://vault.<domain> behind Traefik, http://<lan-ip>:<port> without it —
which is exactly what vaultwarden means by DOMAIN. Prior to the blanking the
value was "https://<app>." with a trailing dot, which started but pointed at a
host that never resolved, so this was broken before too, just quietly.

Verified: base and instance both come up and serve 200 on their own random
ports, each with DOMAIN set to its own address, and with distinct IPs and admin
tokens. Both were then removed; nothing left behind.

Four other apps interpolate the same legacy DOMAINSUBNAME_DATA into env vars
and get an empty value with no domain configured — gitea (DOMAIN, SSH_DOMAIN,
ROOT_URL), mastodon (LOCAL_DOMAIN), owncloud (OWNCLOUD_DOMAIN), jitsimeet
(PUBLIC_URL). They start rather than exit, so the breakage is quieter, and the
fix is not uniform: ROOT_URL/PUBLIC_URL want a URL like this one, while
DOMAIN/SSH_DOMAIN/LOCAL_DOMAIN want a bare host that APP_URL cannot supply.
Left alone pending that decision.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

containers/vaultwarden/docker-compose.yml

@@ -19,7 +19,13 @@ services:
     environment:
       - LOGIN_RATELIMIT_MAX_BURST=10
       - LOGIN_RATELIMIT_SECONDS=60
-      - DOMAIN=https://DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
+      # APP_URL, not the bare subdomain: vaultwarden VALIDATES this and refuses to
+      # start without a protocol, so on a box with no CFG_DOMAIN_n set the old
+      # https://<subdomain> form resolved to a bare "https://" and the container
+      # exited. APP_URL is already the address this app is reached at in both
+      # worlds — https://vault.<domain> behind Traefik, http://<lan-ip>:<port>
+      # without it — which is exactly what DOMAIN means here.
+      - DOMAIN=APP_URL_DATA #LIBREPORTAL|APP_URL_TAG|APP_URL_DATA
       - ADMIN_TOKEN=VAULTWARDEN_ADMIN_TOKEN_1_DATA #LIBREPORTAL|VAULTWARDEN_ADMIN_TOKEN_1_TAG|VAULTWARDEN_ADMIN_TOKEN_1_DATA
       - SIGNUPS_ALLOWED=VAULTWARDEN_SIGNUPS_ALLOWED_DATA #LIBREPORTAL|VAULTWARDEN_SIGNUPS_ALLOWED_TAG|VAULTWARDEN_SIGNUPS_ALLOWED_DATA
     labels: