Review inconsistent runtime defaults and `frontend_urls` validation

[kosmosac]

While comparing config_sample.json and docs/config.jsonc with default_config in src/config.py ( see #9 ), I found several inconsistent runtime defaults.

This issue is separate from corrections to the sample configuration files because some of these values affect validation and fallback behavior.

Frontend URLs

default_config currently uses:

"frontend_urls": {
    "member": "https://{domain}/member?userid={userid}",
    "delivery": "https://{domain}/delivery?logid={logid}",
    "email_confirm": "https://{domain}/auth/email?secret={secret}"
}

Both configuration samples use path parameters instead:

"member": "https://{domain}/member/{userid}",
"delivery": "https://{domain}/delivery/{logid}"

The current public frontend also defines /member/:userid and /delivery/:logid routes.

There is also a validation problem: validateConfig() accesses cfg["frontend_urls"] before the final top-level defaults are applied. It only adds a missing email_confirm entry. Missing member and delivery entries are not restored, and a completely missing or invalid frontend_urls object can cause validation to fail before default_config is used.

Economy rental cost

default_config sets:

"truck_rental_cost": 0.01

Both configuration samples use 5000. The economy code subtracts this value as a static amount from the delivery revenue. When the setting is missing or invalid, validateConfig() restores the 0.01 default.

Registration email subject

The default registration email subject contains a typo:

"subject": "Register Acccount"

The sample files use Register Account.

[kosmosac]

A deployment using the sample {domain} values exposed another practical effect of this inconsistency. The placeholder is not expanded during configuration validation. As a result:

• generated member, delivery, and email confirmation links can retain the literal {domain} value;
• logo_url can retain the same placeholder;
• the client-config plugin derives and stores {domain} as its frontend domain;
• the frontend configuration page then displays https://{domain}/auth/discord/callback.

The actual Discord callback flow derives its host in the frontend and is not affected by that display value, but the backend-generated URLs can be invalid. Explicit frontend URLs must remain supported because the frontend and API can use different domains.