External Changelog

Add a troubleshooting section for the 502 Bad Gateway returned by the UI
nginx proxy: static assets load but /configs-service/** fails with a DNS
SERVFAIL because the UI proxies to a public FQDN that resolves IPv6-only
inside the IPv4 Docker network. Document the preferred fix (point the UI
at the internal service name via BACKEND_URL=http://ft-configs-service:8080)
and the DNS/extra_hosts alternatives.

Update CORS guidance: the UI is served on both HTTP (3001) and HTTPS (3443),
so CORS_ALLOWED_ORIGINS must list both scheme variants. Switch the .env
examples to host placeholders and warn that the origin is the browser-facing
host, never the internal Docker service name (which belongs in BACKEND_URL).

The container runs as non-root (UID 1001) and writes file logs to the
bind-mounted logs/ directory, which is created as root on the host. Add
a chown step and a note so file logging works instead of silently
falling back to stdout only.

Add a Developer Guide page (anatomy of a config domain, adding a new
domain end-to-end, consuming configs via Hazelcast cache and REST).

Document every env var the service actually reads but that was missing
from the templates: MAIL_LOGIN_URL, AUDIT_RETENTION_DAYS,
AUDIT_REDACTION_FIELDS, ORACLE_SCHEMA, FT_CONFIGS_ACS_EXCLUSION_MODELS_CACHE_NAME.
Fix JWT_SECRET guidance (Base64, openssl rand -base64 32), use example
values for mail settings, and keep the .env files and installation.adoc
snippets identical (comments on separate lines for docker --env-file safety).

Liquibase only creates tables inside an existing schema; the database
and user must be provisioned beforehand. Add a dedicated step with
MySQL and Oracle scripts, and align the Oracle env user with the
provisioning script (ftacs -> configs).