refactor: make engine domain-agnostic — identity from node.env, no hardcoded domain

Drop the hardcoded-domain FQDN regex and every hardcoded domain from commons.
Node identity is now explicit in node.env: APEX_NODE_FQDN (real FQDN,
traefik Host()), APEX_NODE_HOST (public host name — backup --host,
obs/notify instance), APEX_SUBNET. The short name (log prefix, sync/<node>
branch, messages) is derived as the first host label.

notify instance is just the host (no hardcoded prefix); the git bot identity
moves to APEX_GIT_AUTHOR_NAME/EMAIL (node.env) with generic defaults. Alloy
node+instance labels use APEX_NODE_HOST. Fallbacks keep a node working if it
omits a var (host<-fqdn<-hostname).

BREAKING CHANGE: removes APEX_NODE and APEX_CLUSTER env vars; node name is now derived from APEX_NODE_FQDN

engine/lib/notify.py

@@ -1,9 +1,8 @@
 # engine/lib/notify.py
-"""ctx.notify — Telegram notifications (port of root_core_telegram*).
+"""ctx.notify — Telegram notifications.
 
-instance renamed com.ermnvldmr.root.<node> -> com.ermnvldmr.apex.<node>. POSTs
-application/x-www-form-urlencoded via urllib (stdlib) — functionally identical to
-the bash curl multipart for Telegram sendMessage.
+The alert `instance` is the node's public host (APEX_NODE_HOST), passed in from the
+context. POSTs application/x-www-form-urlencoded via urllib (stdlib).
 """
 from __future__ import annotations
 import html
@@ -20,7 +19,7 @@ def build_text(title: str, message: str, node: str, level: str, ts: str) -> str:
         severity = "critical"
     elif level == "WARN":
         severity = "warning"
-    instance = f"com.ermnvldmr.apex.{node}"
+    instance = node
     msg = message if len(message) <= 200 else message[:200] + "..."
     msg = html.escape(msg)
     safe_title = html.escape(title)