[web] Self-hosted deployment: UI doesn't reflect server-side config + auth token exposure risk

Context

I want to deploy @workflow/web to Vercel as a standalone observability dashboard that connects to workflows running in other projects. Environment variables are set in the Vercel project settings, and the UI should reflect this configuration without requiring URL params.

Problem

1. UI doesn't reflect server-side configuration

The client is unaware of server-side env vars, causing it to default to "Connected to: Local" even when WORKFLOW_TARGET_WORLD=vercel is set:

2. Documentation leads to a security pitfall

The README explains to set WORKFLOW_TARGET_WORLD=vercel for deployments on Vercel:

https://github.com/vercel/workflow/blob/30c0274cdb2b293015615bd70ee00266c3addbf4/packages/web/README.md?plain=1#L13-L14

However, this is not sufficient which leads users to open the settings form and fill in the configuration (including auth token). Those values are then exposed in URL query params—visible in browser history, server logs, and referer headers.

Current Behavior

version: 4.0.1-beta.15

• ✅ Server actions correctly read env vars (API calls work)
• ❌ UI shows "Connected to: Local" regardless of env vars
• ❌ Settings form exposes auth token in URL when submitted

Workaround:

• Access via /?backend=vercel—but this is undocumented.
• Set Backend to vercel via the UI WITHOUT filling in any other fields—but this is undocumented.

Proposed Solution

1. Update docs to clarify set up and warn users to not submit sensitive credentials when self-hosting.
2. Pass server config to client with merge priority:
   • URL query params (highest—for CLI compatibility)
   • Env vars (for self-hosted deployments)
   • Default values (fallback)
     ---> This way the backend is configured on initial load.
3. Conditionally disable auth token input for remote backends
   • When backend=vercel: disable the token field and display a note indicating auth must be configured via WORKFLOW_API_TOKEN env var
   • When backend=local: keep the field enabled (local development doesn't carry the same URL exposure risk)
   • Alternatively, if the field must remain for edge cases, display a prominent warning.

I would be happy to help with 2. and 3. if this approach aligns with the project's direction.

Start with packages/web/README.md and the @workflow/web configuration and settings form described in the issue. Trace how server environment variables and URL parameters reach the client, then verify that remote auth tokens are not placed in URL parameters and that the UI reflects the configured backend; document the self-hosted setup and security warning.