feat: sign in from any computer, no private network needed

granthi-link is now public at https://granthi-link.shre.ai (cloudflared,
origin still tailnet-only), so the client defaults there instead of a tailnet
IP. Internal machines pass --server or GRANTHI_LINK_SERVER.

Two rollout traps recorded in the README: a third-level hostname
(link.granthi.shre.ai) fails TLS because Cloudflare Universal SSL covers
shre.ai and *.shre.ai only; and exposure REQUIRES trust_forwarded_for with
the tunnel as the sole trusted proxy, or every request looks like the tunnel
and one abuser spends everyone's rate budget.

178 tests.

tests/test_client.py

@@ -1102,5 +1102,23 @@ class TestPruneClockIsPersisted(GitScenarioBase):
         self.assertEqual(pruner.call_count, 0)  # no snapshot folders linked
 
 
+
+class TestDefaultServer(unittest.TestCase):
+    """A new computer must be able to sign in without joining a private
+    network first -- that is the whole point of exposing the endpoint."""
+
+    def test_default_server_is_public_https(self):
+        self.assertTrue(client.DEFAULT_SERVER.startswith("https://"),
+                        client.DEFAULT_SERVER)
+        self.assertNotIn("100.111.", client.DEFAULT_SERVER)
+
+    def test_env_override_wins_for_internal_machines(self):
+        import importlib
+        with mock.patch.dict(os.environ,
+                             {"GRANTHI_LINK_SERVER": "http://10.0.0.5:3042"}):
+            reloaded = importlib.reload(client)
+            self.assertEqual(reloaded.DEFAULT_SERVER, "http://10.0.0.5:3042")
+        importlib.reload(client)  # restore for the rest of the suite
+
 if __name__ == "__main__":
     unittest.main()