Make the media CDN URL configurable instead of hardcoding cdn.cwa.rocks

api/config/services.php hardcodes the template's own CDN in two places:

->tag(FilesystemProvider::FILESYSTEM_ADAPTER_TAG, [ 'alias' => 'gcloud', 'config' => [ 'public_url' => 'https://cdn.cwa.rocks/', 'prefix' => '_preview' ] ]);
// ...
'$rootUrl' => 'https://cdn.cwa.rocks/',

Every project has to edit this file to point media at its own CDN (e.g. hbcp-2026 1dd66f1). If a project forgets, uploaded media URLs and cached image URLs point at cdn.cwa.rocks. The file then drifts from the template, which makes later template updates harder to merge.

Proposal

Make the CDN URL configurable, set in the same places as GCLOUD_BUCKET:

• api/config/services.php: read it with %env(...)% for both public_url and $rootUrl
• api/.env: add a default next to GCLOUD_BUCKET=
• helm/cwa/values.yaml, templates/configmap.yaml, templates/deployment.yaml: pass it to the php container
• bin/devops/k8s.sh: take it from a CI/CD variable, with a fallback

The prefix (_preview) is probably project-specific too and could be handled the same way.

Constraint: no unused environment variables

Builds fail if an environment variable is declared but never used, so all of these changes have to land together:

• Only add the variable where it is actually consumed. Don't leave a declaration behind in .env, Helm or CI without a matching %env()%, or the other way round.
• The GCS adapter is always registered, so the variable is used on every deploy. It needs a safe default wherever it is declared, as GCLOUD_BUCKET has (no-gcloud-bucket).
• Check for a default that doesn't need a new variable at all, e.g. deriving the URL from the bucket (https://storage.googleapis.com/<bucket>/). Projects with a CDN domain would then override it.

Start with api/config/services.php and trace how GCLOUD_BUCKET is declared and passed through api/.env, helm/cwa/values.yaml, templates/configmap.yaml, templates/deployment.yaml, and bin/devops/k8s.sh. Decide whether the CDN URL and possibly the _preview prefix use environment variables or a bucket-derived default, preserving safe defaults and matching declarations to %env()% consumption. Done means both URLs resolve to the configured or default value without unused-variable build failures.