Send a bug report to one place, on purpose, after reading it

The page built its own markdown and nothing could send it; local and upstream
are different people, so neither falls back to the other.

Deployment/host.conf.template

@@ -124,6 +124,17 @@
 # Create in Gitea: Settings → Applications → Generate Token → scope: write:user
     HOSTN_GITEA_API_TOKEN=""
 
+# ━━━ Bug Reports ━━━
+# Only used when BUG_REPORT_LOCAL_ENABLED=true in master.conf. Reports then go to this Gitea
+# instead of GitHub — and stay there, so they do not reach the Varaverk maintainer.
+#
+# Reached locally or over Tailscale, so the token never crosses the public proxy and no Authelia
+# bypass is needed. It is a credential and lives here rather than master.conf for that reason;
+# it is never shipped, and the settings UI masks it.
+    HOSTN_BUG_REPORT_URL=""      # e.g. http://gitea:3000 or the tailnet name
+    HOSTN_BUG_REPORT_REPO=""     # owner/repo
+    HOSTN_BUG_REPORT_TOKEN=""    # Gitea API token with issue-write on that repo
+
 # ━━━ Notifications ━━━
 # Discord webhook — leave blank to disable.
     HOSTN_DISCORD_WEBHOOK=""

Deployment/master.conf.template

@@ -1922,6 +1922,22 @@
 # anything that in practice means "mine". Matched as literal text, not as patterns.
     AI_CHAT_MY_SYSTEM_PHRASES=""
 
+# ━━━ Bug Reports ━━━
+# A bug the assistant files is written here and goes nowhere until the owner sends it. Nothing is
+# ever transmitted automatically — the report is shown in full, read-only, and sending is a
+# second, separate press.
+#
+# Two destinations, and they are not a fallback chain. Fetching code from several mirrors is
+# harmless because they all serve the same thing; sending a report is not, because the
+# destinations are different people. Local ships OFF so an install that has configured nothing
+# reports upstream rather than silently into a tracker nobody reads.
+#
+# LOCAL ON  — reports go to your own Gitea (see HOSTN_BUG_REPORT_* in host*.conf) and stay there.
+#             They do NOT reach the Varaverk maintainer. Turn it on if you want your own backlog.
+# LOCAL OFF — reports open a prefilled GitHub issue you submit under your own account.
+    BUG_REPORT_LOCAL_ENABLED=false
+    BUG_REPORT_GITHUB_REPO="FailedProxy/Varaverk"
+
 # ━━━ AI Conf Write Access ━━━
 # Separate switch from AI_ENABLED, off by default, and an explicit key whitelist. Never paths,
 # never credentials, never a container name. An empty whitelist means no writes regardless of