feat: drive domain from DOMAIN env var -- no manual find-and-replace

Previously every example.com had to be found and replaced manually.
Now a single DOMAIN=yourdomain.com in .env propagates everywhere:

- .env.example: add DOMAIN=example.com with explanation
- docker-compose.yml: pass DOMAIN into authelia container environment
- authelia/configuration.yml: use {{ env "DOMAIN" }} in totp.issuer,
  access_control.rules, and all four session.cookies[] fields
  (Authelia 4.38+ Go template substitution)
- caddy/Caddyfile: use {env.DOMAIN} in all site block addresses
  (Caddy native env substitution); update header comment explaining
  how to set DOMAIN for system vs dockerized Caddy
- README.md: update step 3 to explain DOMAIN is the only change needed;
  update step 4 to say just uncomment the right rule; update Caddy
  wiring section with DOMAIN env var instructions for both Caddy modes

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC

README.md

@@ -209,15 +209,15 @@ openssl rand -hex 32 > authelia/secrets/SESSION_SECRET
 openssl rand -hex 32 > authelia/secrets/STORAGE_ENCRYPTION_KEY
 chmod 600 authelia/secrets/*
 
-# 3) Copy and edit .env.
+# 3) Copy and edit .env -- this is the only place you set your domain.
+#    DOMAIN flows into authelia/configuration.yml and caddy/Caddyfile
+#    automatically via each tool's env-var substitution; no find-and-replace.
 cp .env.example .env
-$EDITOR .env    # set TZ; pin AUTHELIA_VERSION if you want
+$EDITOR .env    # set DOMAIN, TZ; pin image versions if you want
 
-# 4) Edit authelia/configuration.yml.
-#    Replace every `example.com` with your real root domain.
-#    Look for the four CHANGE comments: totp.issuer, session.cookies[].domain,
-#    session.cookies[].authelia_url, session.cookies[].default_redirection_url.
-#    Also uncomment access_control.rules entries for the sites you want to gate.
+# 4) Uncomment access_control.rules in authelia/configuration.yml for the
+#    sites you want to gate. The domain is already templated -- just
+#    uncomment the right case block and choose one_factor or two_factor.
 $EDITOR authelia/configuration.yml
 
 # 5) Create your first user.
@@ -254,11 +254,23 @@ Open `caddy/Caddyfile`. It defines:
 - `(authelia)` -- reusable snippet: add `import authelia` to any site block.
 - `(accesslog)` -- writes Caddy's JSON access log to `/var/log/caddy/access.log`
   so fail2ban's `caddy-4xx` jail can watch it.
-- `auth.example.com` -- the Authelia portal.
-- Example site blocks for all four cases (cases 1-3 active, case 4 commented).
+- `auth.{env.DOMAIN}` -- the Authelia portal.
+- Example site blocks for all four cases.
 
-Copy the relevant blocks into your real Caddyfile, replace `example.com` with
-your domain and `192.168.x.x` with real upstream IPs, then reload Caddy.
+Copy the relevant blocks into your real Caddyfile and replace `192.168.x.x`
+with real upstream IPs. The domain is already templated as `{env.DOMAIN}` --
+just make sure the `DOMAIN` environment variable is available to Caddy:
+
+```bash
+# Dockerized Caddy -- add to its .env or compose environment:
+DOMAIN=yourdomain.com
+
+# System Caddy -- add to /etc/caddy/caddy.env (or wherever systemd reads env):
+echo 'DOMAIN=yourdomain.com' | sudo tee -a /etc/caddy/caddy.env
+# Then make sure the systemd unit loads it:
+# EnvironmentFile=/etc/caddy/caddy.env  (in the [Service] section)
+sudo systemctl daemon-reload && sudo systemctl reload caddy
+```
 
 **Every** site block should have `import accesslog` -- even case 4 sites.
 fail2ban's caddy-4xx jail watches the one log file and covers all your