chore: align extraction dependencies and document hosted routing

Author: emir-karabeg

README.md

@@ -127,6 +127,8 @@ Chat is a Sim-managed service. `npx sim-setup` connects a Chat API key for you 
 
 ## Environment Variables
 
+Authentication, the application, and docs live in this repository. The public marketing website builds and deploys independently. Self-hosted installations open authentication at `/` and require no website service. Hosted Sim uses `LANDING_INTERNAL_ORIGIN` for a bounded, credential-free server request for the anonymous homepage; auth and API requests always remain with this application. Integrations and models remain canonical here, with model docs and historical catalog redirects generated by `bun run reference-docs:generate`.
+
 See the [environment variables reference](https://docs.sim.ai/self-hosting/environment-variables) for the full list, or [`apps/sim/.env.example`](apps/sim/.env.example) for defaults.
 
 ## Tech Stack

apps/sim/.env.example

@@ -20,6 +20,7 @@ BETTER_AUTH_URL=http://localhost:3000
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 # NEXT_PUBLIC_STATUS_NOTICE_PREVIEW=true  # Force the sidebar service-status notice into its critical preview state for testing
 # INTERNAL_API_BASE_URL=http://sim-app.default.svc.cluster.local:3000  # Optional: internal URL for server-side /api self-calls; defaults to NEXT_PUBLIC_APP_URL
+# LANDING_INTERNAL_ORIGIN=http://site.landing.staging.sim.internal:8080  # Hosted Sim only: private static homepage origin. Self-hosted installs redirect to auth and do not need this.
 # SIM_MCP_URL=https://mcp.example.com/mcp  # Optional: dedicated host for the Sim MCP server; defaults to NEXT_PUBLIC_APP_URL/api/mcp
 # TRUSTED_ORIGINS=https://www.example.com,https://app.example.com  # Optional: comma-separated additional public origins to trust for auth (apex+www, alias domains). Merged into Better Auth trustedOrigins.
 # AUTH_TRUSTED_PROXIES=10.0.0.0/24,192.0.2.10  # Optional: reverse-proxy IPs/CIDRs in front of the app. Better Auth walks x-forwarded-for right to left, skips these hops, and uses the first untrusted address as the client IP (prevents forwarded-header spoofing). Use your proxies' actual addresses, not broad private ranges that also cover clients.

apps/sim/next.config.ts

@@ -21,12 +21,7 @@ const nextConfig: NextConfig = {
   },
   images: {
     formats: ['image/avif', 'image/webp'],
-    /**
-     * Allowed `quality` values for next/image. 75 is the app-wide default;
-     * 90 exists for large photographic marketing assets (the landing hero
-     * backdrop) where the default visibly softens texture.
-     */
-    qualities: [75, 90],
+    qualities: [75],
     remotePatterns: [
       {
         protocol: 'https',