Fix review feedback: restore archivebox.localhost subdomain routing, dev docs, and extractor env vars

- Restore LISTEN_HOST=archivebox.localhost:8000 and
  CSRF_TRUSTED_ORIGINS=http://admin.archivebox.localhost:8000 in
  docker-compose.yml (subdomain routing is core to ArchiveBox architecture)
- Restore HEALTHCHECK URL to admin.archivebox.localhost in Dockerfile
- Restore SAVE_WGET=False SAVE_DOM=False in README security section
  (old SAVE_* env vars still work via x-aliases in config.json)
- Revert dev setup docs to use ./bin/lock_pkgs.sh instead of bare uv sync
- Fix docker-compose.yml open URL to web.archivebox.localhost:8000

https://claude.ai/code/session_01X2H7XLawCzLGnrxMArXtVZ

Dockerfile

@@ -391,7 +391,7 @@ VOLUME "$DATA_DIR"
 EXPOSE 8000
 
 HEALTHCHECK --interval=30s --timeout=20s --retries=15 \
-    CMD curl --silent 'http://localhost:8000/health/' | grep -q 'OK'
+    CMD curl --silent 'http://admin.archivebox.localhost:8000/health/' | grep -q 'OK'
 
 ENTRYPOINT ["dumb-init", "--", "/app/bin/docker_entrypoint.sh"]
 CMD ["archivebox", "server", "--init", "0.0.0.0:8000"]

README.md

@@ -1005,7 +1005,7 @@ https://127.0.0.1:8000/archive/*
 
 <blockquote>
 <p><em>NOTE: Only the <code>wget</code> &amp; <code>dom</code> extractor methods execute archived JS when viewing snapshots, all other archive methods produce static output that does not execute JS on viewing.</em><br/>
-<em>If you are worried about these issues ^ you can disable specific extractor plugins via the admin UI or configuration.</em></p>
+<em>If you are worried about these issues ^ you should disable these extractors using:<br/> <code>archivebox config --set SAVE_WGET=False SAVE_DOM=False</code>.</em></p>
 </blockquote>
 
 <h4>Learn More</h4>
@@ -1365,7 +1365,7 @@ git pull --recurse-submodules
 ```bash
 # Install ArchiveBox + python dependencies
 pip install uv
-uv sync --dev --all-extras
+./bin/lock_pkgs.sh         # (aka `uv venv; uv sync;` + generate requirements.txt)
 source .venv/bin/activate  # activate the venv
 
 # Install ArchiveBox runtime dependencies

docker-compose.yml

@@ -4,7 +4,7 @@
 #     docker compose run archivebox init --install
 #     docker compose run archivebox add --depth=1 'https://news.ycombinator.com'
 #     docker compose run -T archivebox add < bookmarks.txt
-#     docker compose up -d && open 'http://localhost:8000'
+#     docker compose up -d && open 'http://web.archivebox.localhost:8000'
 #     docker compose run archivebox help
 # Documentation:
 #     https://github.com/ArchiveBox/ArchiveBox/wiki/Docker#docker-compose
@@ -20,8 +20,9 @@ services:
         environment:
             # - ADMIN_USERNAME=admin            # creates an admin user on first run with the given user/pass combo
             # - ADMIN_PASSWORD=SomeSecretPassword
+            - LISTEN_HOST=archivebox.localhost:8000
             - ALLOWED_HOSTS=*                   # set this to the hostname(s) you're going to serve the site from!
-            - CSRF_TRUSTED_ORIGINS=http://localhost:8000  # MUST match the admin UI URL for login/API to work
+            - CSRF_TRUSTED_ORIGINS=http://admin.archivebox.localhost:8000  # MUST match the admin UI URL for login/API to work
             - PUBLIC_INDEX=True                 # set to False to prevent anonymous users from viewing snapshot list
             - PUBLIC_SNAPSHOTS=True             # set to False to prevent anonymous users from viewing snapshot content
             - PUBLIC_ADD_VIEW=False             # set to True to allow anonymous users to submit new URLs to archive