Harden gameplay timing and map loading

docs/local-network.md

@@ -36,6 +36,9 @@ MINEGEO_ALLOW_ANY_ORIGIN=true
 
 This bypasses MineGeo's browser origin checks, including their CSRF protection.
 The default is `false`; only the exact value `true` enables the bypass.
+Use `npm run dev` for this testing mode. Production ignores the bypass, and
+`npm start` refuses to launch when it is enabled. Public production URLs must use
+HTTPS; loopback HTTP remains available for testing a production build locally.
 Authentication, permissions, and JSON request requirements still apply. This
 setting controls MineGeo's API checks; Supabase email sign-in still needs allowed
 redirect URLs, and `MINEGEO_URL` still controls capture-tool pairing links.