Disclose backend hardening and route changes

backend/.env.example

@@ -1,12 +1,12 @@
 PORT=3001
 FRONTEND_URL=http://localhost:3000
-
-# HMAC key used to sign /download/:token URLs. Required at startup.
-# Generate with: openssl rand -hex 32
-# Use a dedicated secret distinct from SUPABASE_SECRET_KEY.
-DOWNLOAD_SIGNING_SECRET=replace-with-a-random-32-byte-hex-string
 SUPABASE_URL=https://your-project.supabase.co
 SUPABASE_SECRET_KEY=your-supabase-service-role-key
+# Required for cross-tenant test suite (npm run test:cross-tenant) to sign test
+# users into anon-key sessions and obtain real JWTs. Optional for runtime.
+SUPABASE_ANON_KEY=
+
+DOWNLOAD_SIGNING_SECRET=your-random-signing-secret-min-32-chars
 
 R2_ENDPOINT_URL=https://your-account-id.r2.cloudflarestorage.com
 R2_ACCESS_KEY_ID=your-r2-access-key
@@ -15,6 +15,25 @@ R2_BUCKET_NAME=mike
 
 GEMINI_API_KEY=your-gemini-key
 ANTHROPIC_API_KEY=your-anthropic-key
-OPENAI_API_KEY=your-openai-key
+
+# Optional — when set, enables raw LLM stream console logging (debug only; remove in production)
+LLM_STREAM_DEBUG=
+
+OPENROUTER_API_KEY=your-openrouter-key
 RESEND_API_KEY=your-resend-key
-USER_API_KEYS_ENCRYPTION_SECRET=your-long-random-secret
+
+# Migration runner — Supabase direct connection, NOT the pgBouncer pooler.
+# Format: postgresql://postgres:<password>@db.<project-ref>.supabase.co:5432/postgres
+DATABASE_URL=
+
+# LLM rate limiting (per-user, applies to all LLM-spending routes)
+RATE_LIMIT_WINDOW_MS=60000   # Sliding window in milliseconds (default: 60000 = 1 minute)
+RATE_LIMIT_MAX=20            # Max LLM requests per user per window (default: 20)
+
+# CLEAN-05 — at-rest encryption of user LLM API keys (AES-256-GCM)
+# Generate with: openssl rand -hex 32
+HUGO_MASTER_KEY=
+
+# CLEAN-44 — HMAC secret for account-restore tokens (30-day soft-delete window)
+# Generate with: openssl rand -base64 48
+HUGO_RESTORE_TOKEN_SECRET=

backend/.gitignore

@@ -3,5 +3,4 @@ dist
 .env*
 !.env.example
 *.log
-logs/
 .DS_Store

backend/nixpacks.toml

@@ -1,2 +1,2 @@
 [phases.setup]
-nixPkgs = ["...", "libreoffice"]
+nixPkgs = ["libreoffice"]