refactor: make engine domain-agnostic — identity from node.env, no hardcoded domain

Drop the hardcoded-domain FQDN regex and every hardcoded domain from commons.
Node identity is now explicit in node.env: APEX_NODE_FQDN (real FQDN,
traefik Host()), APEX_NODE_HOST (public host name — backup --host,
obs/notify instance), APEX_SUBNET. The short name (log prefix, sync/<node>
branch, messages) is derived as the first host label.

notify instance is just the host (no hardcoded prefix); the git bot identity
moves to APEX_GIT_AUTHOR_NAME/EMAIL (node.env) with generic defaults. Alloy
node+instance labels use APEX_NODE_HOST. Fallbacks keep a node working if it
omits a var (host<-fqdn<-hostname).

BREAKING CHANGE: removes APEX_NODE and APEX_CLUSTER env vars; node name is now derived from APEX_NODE_FQDN

compositions/apex/docker-compose.yml

@@ -202,7 +202,7 @@ services:
       - /etc/machine-id:/etc/machine-id:ro
     environment:
       <<: *shared-environment
-      APEX_NODE: "${APEX_NODE?error}"
+      APEX_NODE_HOST: "${APEX_NODE_HOST?error}"        # node + instance metric/log labels
       # push targets + machine auth (per-node scalars in apex.env / secret .env)
       APEX_LOKI_PUSH_URL: "${APEX_LOKI_PUSH_URL?error}"
       APEX_PROM_PUSH_URL: "${APEX_PROM_PUSH_URL?error}"