feat(docker): fail at start when AUTH_HOST or API_HOST is unset

An empty host gives a CSP connect-src that blocks every API call.
The new entrypoint check stops the container early with a clear error.

README.md

@@ -405,7 +405,8 @@ Production image (container env, read by nginx at start):
 | `AUTH_HOST` | Auth host name for the CSP `connect-src` |
 | `API_HOST` | Core host name, same |
 
-Both default to empty in the image; `docker-compose.yml` of the Deployment repo passes them. `FRONTEND_HOST` is not
+The image refuses to start when either is unset or empty (`docker-entrypoint.d/10-require-hosts.sh`);
+`docker-compose.yml` of the Deployment repo passes both. `FRONTEND_HOST` is not
 passed to the frontend image; compose uses it for the Traefik rule and as `APP_FRONTEND_URL` of Auth and Core (Deployment `docker-compose.yml`:68,152).
 
 ## Tests and build