fix(self-hosting): use instance contacts and live product name (#3333)

fluxer_docs/src/content/docs/admin-api/instance.mdx

@@ -294,7 +294,7 @@ Branding, legal, setup and registration field policy, in the Admin form of what
 | --- | --- | --- |
 | branding | [public branding](/http-api/instance/#public-branding-object) object | Product name, image URLs, and theme colour |
 | setup<sup>1</sup> | object | Has the single boolean `configured` |
-| legal | [public legal configuration](/http-api/instance/#public-legal-configuration-object) object | Terms and privacy URLs |
+| legal | [public legal configuration](/http-api/instance/#public-legal-configuration-object) object | Terms, privacy, and community guidelines URLs |
 | registration<sup>2</sup> | [public registration fields](/http-api/instance/#public-registration-fields-object) object | Registration field collection policy |
 
 <sup>1</sup> The [Instance](/http-api/instance/) resource publishes `admin_url` in this object as well
@@ -360,7 +360,7 @@ Outbound email settings, and the provider resolved from them.
 | provider | ?string | Operator override of `smtp` or `none`, or null for no override |
 | effective_provider | string | Provider in use, either `smtp` or `none` |
 | from_email | ?string | Envelope sender address |
-| from_name | ?string | Envelope sender name |
+| from_name | ?string | Envelope sender name, or null when none is set and mail is sent under the instance product name |
 | smtp<sup>1</sup> | object | `host`, `port`, `username`, `secure`, and `password_set` |
 | disable_new_ip_authorization | boolean | Whether new-IP authorisation email is suppressed by the stored setting |
 | effective_disable_new_ip_authorization<sup>2</sup> | boolean | Whether it is suppressed once outbound email state is taken into account |
@@ -622,7 +622,7 @@ The body has one optional object for each section. Fluxer leaves an absent secti
 
 <sup>1</sup> The supplied fields are merged over the stored configuration and the result is validated as a whole. Every supplied endpoint URL uses `https`, has no credentials and no fragment, and resolves to a publicly routable address, otherwise the request returns 400 `INVALID_FORM_BODY` with `INVALID_URL_FORMAT` or `URL_NOT_PUBLICLY_ROUTABLE`
 
-<sup>2</sup> `branding.product_name` is 1 to 80 characters, every branding and legal URL is at most 2048 characters and nullable, `branding.theme_color` is at most 64 characters and nullable, and `setup.configured` and `registration.collect_date_of_birth` are booleans. `branding.premium_product_name` is 1 to 40 characters, and null restores the default. `branding.premium_info_url` is an absolute `http` or `https` URL. Every string is trimmed before it is stored
+<sup>2</sup> `branding.product_name` is 1 to 80 characters, every branding and legal URL is at most 2048 characters and nullable, `branding.theme_color` is at most 64 characters and nullable, and `setup.configured` and `registration.collect_date_of_birth` are booleans. `branding.premium_product_name` is 1 to 40 characters, and null restores the default. `branding.premium_info_url` and `legal.guidelines_url` are absolute `http` or `https` URLs. Every string is trimmed before it is stored, and null or an empty string clears a legal URL
 
 `push_relay` takes only `relay_consent_accepted`. Fluxer sets `relay_consent_accepted_at` and `relay_consent_accepted_by` itself on the request that changes that flag, and accepts neither from a request. Turning the flag on stamps the current time and the acting account, and turning it off clears both to null. A request that repeats the flag it already holds leaves the stamp alone.
 

fluxer_docs/src/content/docs/http-api/errors.md

@@ -25,7 +25,7 @@ The error code determines which supplementary members a failure has, and most co
 `GLOBAL_IP_BANNED` and `GLOBAL_IP_TEMPORARILY_BANNED` have their own members:
 
 - `ip_address` is the normalised client address.
-- `appeal_email` is the address an appeal is sent to.
+- `appeal_email` is the address an appeal is sent to. It is `null` on a self-hosted instance, where `message` points at the administrators of the instance and names no address.
 - `appeals_supported` is `true` for both kinds of ban.
 - `ban_kind` is `permanent` or `temporary_24h`. `temporary_24h` covers every ban that records an expiry, whatever its length.
 - `expires_at` is an ISO 8601 timestamp when the ban records an expiry, and `null` otherwise, including on every permanent ban.
@@ -468,11 +468,11 @@ Gift code is already redeemed
 
 ### `GLOBAL_IP_BANNED`
 
-Your IP address {ipAddress} has been permanently blocked from the Fluxer API by platform administrators
+Your IP address {ipAddress} has been permanently blocked from the {product_name} API by platform administrators
 
 ### `GLOBAL_IP_TEMPORARILY_BANNED`
 
-Your IP address {ipAddress} has been temporarily blocked from the Fluxer API
+Your IP address {ipAddress} has been temporarily blocked from the {product_name} API
 
 ### `GONE`
 

fluxer_docs/src/content/docs/http-api/instance.mdx

@@ -407,7 +407,7 @@ Branding, setup state, legal documents, and registration fields a client reads b
 | --- | --- | --- |
 | branding | [public branding](#public-branding-object) object | Public instance identity |
 | setup | [public setup state](#public-setup-state-object) object | Initial configuration state |
-| legal | [public legal configuration](#public-legal-configuration-object) object | Registration legal document URLs |
+| legal | [public legal configuration](#public-legal-configuration-object) object | Legal and policy document URLs |
 | registration | [public registration fields](#public-registration-fields-object) object | Registration field collection policy |
 
 ## Public branding object
@@ -448,7 +448,7 @@ Whether the deployment has finished its initial configuration, and where an oper
 
 ## Public legal configuration object
 
-The public URLs a client links from its registration form.
+The public document URLs a client links from its registration form and its report flows.
 
 ### Structure
 
@@ -456,6 +456,9 @@ The public URLs a client links from its registration form.
 | --- | --- | --- |
 | terms_url | ?string | Public terms of service URL, or null |
 | privacy_url | ?string | Public privacy policy URL, or null |
+| guidelines_url<sup>1</sup> | ?string | Public community guidelines URL, or null |
+
+<sup>1</sup> The URL the operator set. A [report flow](/http-api/reports/#report-flows) and the account enforcement emails link it. When it is null, a hosted instance links its own guidelines page, and a self-hosted instance hides every guidelines link
 
 ## Public registration fields object
 

fluxer_docs/src/content/docs/operator/configuration.mdx

@@ -768,7 +768,7 @@ The same conditions turn on a DNS check at registration. The check runs when ema
 
 #### `FLUXER_EMAIL_FROM_NAME`
 
-`.env.example` `Fluxer`. The sender name. Default `Fluxer`, which an empty value also gives. Compose forwards it from `.env`.
+`.env.example` empty. The sender name. Default empty. An empty value sends mail under the instance product name, which is the name saved in the admin dashboard or else `FLUXER_APP_PRODUCT_NAME`, and a rename in the dashboard applies to the next email. A set value always wins. Compose forwards it from `.env`.
 
 #### `FLUXER_EMAIL_REPLY_TO_EMAIL`
 
@@ -1203,7 +1203,7 @@ Compose forwards every name below from `.env`. The admin dashboard also sets the
 
 #### `FLUXER_APP_PRODUCT_NAME`
 
-Default `Fluxer`. The product name clients display. Also settable in the admin dashboard, which wins. Compose forwards it from `.env`.
+Default `Fluxer`. The product name clients display and the API writes in its emails and report flows. Also settable in the admin dashboard, which wins. Compose forwards it from `.env`.
 
 #### `FLUXER_APP_ICON_URL`
 
@@ -1737,7 +1737,7 @@ The admin dashboard at `FLUXER_ADMIN_BASE_PATH` stores these in the database. Th
 
 #### Instance Config, Public App Identity
 
-Product name, client-visible brand assets, the terms, privacy, and community guidelines links, and the setup state in the instance discovery document. No environment variable sets a legal link. On a self-hosted instance, the enforcement emails list only the terms and guidelines links set here, and the clients and report flows show no guidelines link until one is set.
+Product name, client-visible brand assets, the terms, privacy, and community guidelines links, and the setup state in the instance discovery document. No environment variable sets a legal link. On a self-hosted instance, the enforcement emails list only the terms and guidelines links set here, and the clients and report flows show no guidelines link until one is set. Its emails and its IP block errors name no contact address. They tell the reader to contact the administrators of the instance, and no setting adds an address. The emails, the report flows, the IP block errors, the title of an APNs alert that has none, and the built-in admin application use the product name set here, and a rename applies without a restart.
 
 #### Instance Config, Registration Controls