PR-B2: point vaultwarden + actual-budget URL defaults at ${HOLA_APP_HOST} (after hola token-resolution release)

[pofallon]

Tracking issue for PR-B2 — the deferred "wave-2" typed-param migration for the two apps whose URL default should point at the platform host token.

What

Change the URL defaultEnv defaults for these apps from placeholder values to the platform token so the install wizard prefills the real reachable URL with no operator input:

• vaultwarden — DOMAIN: https://vaultwarden.example.com → https://${HOLA_APP_HOST}
• actual-budget — hostname/URL field → https://${HOLA_APP_HOST}

Why it's blocked

This only works once the hola server resolves ${HOLA_APP_HOST} / ${HOLA_BASE_DOMAIN} in defaultEnv values at deploy time (the .env writer). That resolution is part of the typed-app-params server work (PR2 on hola's feat/typed-app-params) and is not in a released hola yet.

The catalog is fetched by whatever hola version a user runs, so shipping a ${HOLA_APP_HOST} default before that resolution is in a released server would cause older servers to write the literal unresolved token into the app's env and break it.

Gating sequence

1. Land the typed-app-params server work in hola (deploy-time platform-token resolution).
2. Cut a hola release containing it.
3. Then do this PR: bump vaultwarden + actual-budget with the token-based URL defaults.

Notes

• Wave 1 (the 7-app typed-field migration that's already merged on feat/typed-manifest-migration) was deliberately scoped to changes that are safe against any server version; this is the piece intentionally held back.
• Do not start until the gating hola release is confirmed shipped.