build: per-environment Grav config override (prod Twig prod-mode)

Prod needs twig.cache:true / debug:false / auto_reload:false, but those
values break local dev, so they must not live in the committed
system.yaml. Add a per-environment override deployed only to the server
via Grav's environment://config (user/env/<host>/config/system.yaml):

- deploy/env/prod/system.yaml — version-controlled source of truth.
- make remote-apply-env-prod — writes it to the server + clears cache;
  resolves the host in-recipe (WEB_HOST || REMOTE_HOST) to avoid the
  recursive-make empty-export trap.
- remote-diag now shows the deployed override + whether twig cache is
  populating, so prod-mode can be verified not assumed.
- CLAUDE.md §1 rewritten: never flip committed system.yaml; use the
  override. Backlog updated (twig prod-mode + /post login-gate done;
  note stale .env.prod GRAV_VERSION and pending git-sync).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU

Makefile

@@ -14,6 +14,10 @@ REMOTE_PORT ?= 22
 SSH := ssh -p $(REMOTE_PORT) $(REMOTE_USER)@$(REMOTE_HOST)
 WEBROOT ?= $(REMOTE_HOME)/public_html
 SITE_CONFIG_DIR ?= $(REMOTE_HOME)/site-config
+# Hostname Grav uses to pick its per-environment config (user/env/<host>/).
+# Defaults to the SSH host; override in .env.<ENV> only if the web hostname
+# Grav sees differs from the SSH host (e.g. an addon domain on a shared box).
+WEB_HOST ?= $(REMOTE_HOST)
 
 # ── Environment guard + generated per-env remote targets ──────────────────────
 # Every remote-* target below gains `-test` / `-prod` variants, e.g.
@@ -22,7 +26,8 @@ SITE_CONFIG_DIR ?= $(REMOTE_HOME)/site-config
 REMOTE_TARGETS := remote-env-setup remote-env-remove remote-wipe remote-install \
 	remote-fetch remote-fetch-content remote-install-plugins remote-update-plugins \
 	remote-upgrade-grav remote-git-sync-disable remote-git-sync-enable \
-	remote-content-status remote-clean remote-diag remote-maintenance-on remote-maintenance-off
+	remote-content-status remote-clean remote-diag remote-apply-env \
+	remote-maintenance-on remote-maintenance-off
 ENVS := test prod
 
 guard-env:
@@ -173,6 +178,18 @@ remote-content-status: guard-env
 remote-clean: guard-env
 	$(SSH) "cd $(WEBROOT) && php bin/grav clearcache"
 
+# Deploy per-environment Grav config overrides to the server's
+# user/env/<WEB_HOST>/config/ tree (deep-merged over the committed config).
+# Source of truth: deploy/env/$(ENV)/system.yaml (version-controlled). This
+# tree is outside the content repo, so it is NOT restored by content sync —
+# re-run after any fresh install.
+remote-apply-env: guard-env
+	@test -f deploy/env/$(ENV)/system.yaml || { echo "ERROR: missing deploy/env/$(ENV)/system.yaml"; exit 1; }
+	@host="$${WEB_HOST:-$(REMOTE_HOST)}"; \
+	  test -n "$$host" || { echo "ERROR: WEB_HOST/REMOTE_HOST unresolved"; exit 1; }; \
+	  $(SSH) "mkdir -p $(WEBROOT)/user/env/$$host/config && cat > $(WEBROOT)/user/env/$$host/config/system.yaml && cd $(WEBROOT) && php bin/grav clearcache" < deploy/env/$(ENV)/system.yaml; \
+	  echo "Applied deploy/env/$(ENV)/system.yaml -> $(WEBROOT)/user/env/$$host/config/system.yaml"
+
 # Read-only health check: plugin install state, versions, key config, log tail.
 remote-diag: guard-env
 	$(SSH) "cd $(WEBROOT) && \
@@ -180,6 +197,8 @@ remote-diag: guard-env
 		echo '=== installed plugin versions ==='; for p in login admin2 flex-objects form api; do printf '%s: ' \"\$$p\"; grep -m1 '^version:' user/plugins/\$$p/blueprints.yaml 2>/dev/null || echo '(NOT installed)'; done; \
 		echo '=== what does GPM say about api? ==='; php bin/gpm info api 2>&1 | head -12; \
 		echo '=== api override (enabled/route/session) ==='; grep -nE '^enabled:|^route:|session_enabled:' user/config/plugins/api.yaml 2>&1; \
+		echo '=== per-env override present? ==='; for f in user/env/*/config/system.yaml; do echo \"\$$f:\"; cat \"\$$f\" 2>/dev/null | grep -E 'cache:|debug:|auto_reload:'; done; \
+		echo '=== twig cache populating? (non-empty => cache on) ==='; ls cache/twig/ 2>/dev/null | head -1 || echo '(empty)'; \
 		echo '=== grav.log tail ==='; tail -8 logs/grav.log 2>/dev/null"
 
 remote-maintenance-on: guard-env