fix(on-device): stop leaking the speaker's own hostname into BMX/TLS URLs

On an on-device install, soundtouch-service defaulted its server URL to
os.Hostname() when --server-url wasn't set. Since the service runs on the
speaker's own Linux, that returns the speaker's internal variant codename
(e.g. "spotty", "mojo") -- never resolvable, not even by the speaker itself
-- breaking TuneIn/BMX playback with CURL ErrorCode 6 (issue #546).

Add a --deployment-mode/DEPLOYMENT_MODE flag (on-device, private-network,
public-network) so the fallback is chosen deliberately instead of guessed:
on-device defaults to localhost, public-network refuses to start rather
than guess a public address, and the previous hostname-guessing behavior
is kept for private-network/unset installs, now with a startup warning.

The on-device init script sets DEPLOYMENT_MODE=on-device automatically and
now auto-exports aftertouch.conf into the daemon's environment generally,
which also unblocks discussion #610 (setting MGMT_USERNAME/MGMT_PASSWORD
on-device) without any further code change.

Verified end-to-end on real ST20 hardware: service now resolves
http://localhost:8000, a re-migrate updates the speaker's own runtime
config to match, and TuneIn playback works again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/on-device-install/README.md

@@ -96,6 +96,24 @@ still reaches AfterTouch on `:8000` as before. Change or disable this with
 rw && curl -sSL https://raw.githubusercontent.com/gesellix/Bose-SoundTouch/main/scripts/on-device-install/install.sh | AFTERTOUCH_LAN_PORT=none sh
 ```
 
+**`aftertouch.conf` isn't limited to `AFTERTOUCH_LAN_PORT`.** The init
+script exports every assignment in this file into the daemon's own
+environment, so any env var `soundtouch-service` reads (see the
+[configuration table](../../docs/content/docs/guides/SOUNDTOUCH-SERVICE.md#configuration-options))
+can be set the same way — for example, to change the admin credentials:
+
+```
+MGMT_USERNAME=admin
+MGMT_PASSWORD=change-me
+```
+
+Edit `/opt/aftertouch/aftertouch.conf` over SSH, then
+`/etc/init.d/aftertouch restart` to apply. `DEPLOYMENT_MODE=on-device` is
+already set by the init script itself — it never needs to be added here.
+The auto-export behavior described here needs a build including the fix
+for issue #546; older installs (before `aftertouch.conf` even existed, or
+between then and that fix) need to reinstall/update first.
+
 Which models need this, and how to report one that isn't listed yet, is
 tracked in
 [MODEL-SUPPORT-MATRIX.md](../../docs/content/docs/reference/MODEL-SUPPORT-MATRIX.md).

scripts/on-device-install/aftertouch

@@ -25,10 +25,19 @@ LOG_TAG="aftertouch"
 export PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
 
 
-# Optional settings written by install.sh (AFTERTOUCH_LAN_PORT, SERVICE_PORT).
+# Optional settings written by install.sh (AFTERTOUCH_LAN_PORT, SERVICE_PORT),
+# or added by hand for anything the daemon reads from its environment
+# (SERVER_URL, MGMT_USERNAME, MGMT_PASSWORD, DEPLOYMENT_MODE, ...). `set -a`
+# auto-exports every assignment while the file is sourced, so any such
+# variable actually reaches the daemon -- it's forked from this same shell's
+# environment further down via `--startas "/bin/sh" -- -c "... \"$DAEMON\" ..."`.
 # Sourced before the defaults below so it can override either.
-# shellcheck source=/dev/null
-[ -r "$CONFFILE" ] && . "$CONFFILE"
+if [ -r "$CONFFILE" ]; then
+  set -a
+  # shellcheck source=/dev/null
+  . "$CONFFILE"
+  set +a
+fi
 
 # Port the daemon binds locally. Kept in one variable because it appears in
 # the daemon arguments, the readiness poll and `status` -- three places that
@@ -39,6 +48,13 @@ SERVICE_PORT="${SERVICE_PORT:-8000}"
 # LAN entry port: a port number, "auto" (default), or "none".
 LAN_PORT_MODE="${AFTERTOUCH_LAN_PORT:-auto}"
 
+# This script only ever runs on the speaker itself, so the deployment mode is
+# not a guess -- default it here (overridable via aftertouch.conf, though that
+# should never be needed). Exported so soundtouch-service picks it up via
+# DEPLOYMENT_MODE without needing a --deployment-mode flag threaded through
+# the daemon invocation below.
+export DEPLOYMENT_MODE="${DEPLOYMENT_MODE:-on-device}"
+
 
 # Sanity check executable
 test -x "$DAEMON" || {

scripts/on-device-install/install.sh

@@ -135,7 +135,13 @@ fi
 CONF_FILE="$INSTALL_DIR/aftertouch.conf"
 if [ -n "${AFTERTOUCH_LAN_PORT:-}" ] || [ ! -f "$CONF_FILE" ]; then
   cat > "$CONF_FILE" <<CONFEOF
-# AfterTouch on-device settings. Sourced by /etc/init.d/aftertouch.
+# AfterTouch on-device settings. Sourced by /etc/init.d/aftertouch, which
+# exports every assignment here into the daemon's own environment -- so any
+# env var soundtouch-service reads (see docs: guides/SOUNDTOUCH-SERVICE.md,
+# "Configuration Options") can be set by adding a line below and running
+# \`/etc/init.d/aftertouch restart\`, e.g.:
+#   MGMT_USERNAME=admin
+#   MGMT_PASSWORD=change-me
 #
 # AFTERTOUCH_LAN_PORT: how AfterTouch is reached from other machines.
 #   auto   (default) redirect a spare Bose port to AfterTouch, but only on