chore: add .env.example, fix .gitignore blanket .env* rule (#3)

.env.example was referenced by README.md and required by docs/09-build-plan.md
(Phase 0) but never existed in the repo. Root cause: .gitignore's `.env*` rule
silently ignored it too, so `git add .env.example` was always a no-op even if
someone created it locally.

- Add .gitignore exception: `!.env.example`.
- Add .env.example covering every process.env.* read found in this pass
  (grep-verified across app/, lib/, src/), organized by concern, each section
  marked "wired in code today" or "documented target, not yet read by code"
  per docs/08-infrastructure.md. No real values; matches repo convention.

Excluded ODOO_BASE_URL: only appears inside a comment describing a past
refactor away from module-level env reads, not an actual process.env read.

pnpm test: 88 passed, 1 todo, 0 failures (13 files, tests/**/*.test.ts).
tsc --noEmit: clean.

.env.example

@@ -0,0 +1,115 @@
+# 0pt (edge plane) — environment inventory
+# See docs/08-infrastructure.md for the canonical description of each integration.
+# Never commit real values. Vercel env for the edge app; VPS .env (git-ignored) for infra/docker-compose.yml.
+#
+# Sections marked "wired in code today" are read via process.env.* somewhere in this repo right now
+# (grep-verified, not assumed). Sections marked "documented target, not yet read by code" come from
+# docs/08-infrastructure.md / docs/02-architecture.md but have no process.env.* read yet -- filling
+# them in unblocks the integration, it does not by itself change behavior.
+
+# ---------------------------------------------------------------------------
+# Database (wired in code today: lib/db.ts, app/api/health)
+# ---------------------------------------------------------------------------
+# Vercel Postgres sets POSTGRES_URL / POSTGRES_PRISMA_URL automatically when the
+# integration is attached. DATABASE_URL, if set, takes priority over both (lib/db.ts
+# fallback order: DATABASE_URL || POSTGRES_URL || POSTGRES_PRISMA_URL).
+DATABASE_URL=
+POSTGRES_URL=
+POSTGRES_PRISMA_URL=
+
+# ---------------------------------------------------------------------------
+# Auth (wired in code today: DEV_LOGIN_KEY gate; AUTH_SECRET declared, full
+# Auth.js flow lands with the DB per README "Status" -- not complete yet)
+# ---------------------------------------------------------------------------
+AUTH_SECRET=
+# AUTH_URL is documented (docs/08) but not yet read by any route in this pass.
+AUTH_URL=https://0pt.app
+DEV_LOGIN_KEY=
+
+# ---------------------------------------------------------------------------
+# Data engine bridge (wired in code today: lib/engine.ts)
+# ---------------------------------------------------------------------------
+# When set, edge route handlers defer to the FastAPI engine (services/api) as the
+# single source of truth (orders/estimates/catalog/ai-parse). When unset, the edge
+# computes locally / falls back to an honest heuristic -- see lib/engine.ts, app/api/ai/parse.
+ENGINE_URL=
+# Sent as X-Internal-Token on every engineFetch() call.
+INTERNAL_TOKEN=
+
+# ---------------------------------------------------------------------------
+# SIAX platform clients (documented target, not yet read by code)
+# ---------------------------------------------------------------------------
+# src/clients/{cl0ud,n0d,aud0}-client.ts currently only accept an optional
+# constructor baseUrl and fall back to an in-memory mock -- none of these three
+# vars is read via process.env yet (grep-verified). Setting them does nothing
+# until those clients are wired to read them; a future pass should add that.
+CL0UD_URL=
+N0D_URL=
+AUD0_URL=
+# ST0RE_URL IS read (src/clients/st0re-client.ts, src/clients/st0re-lakehouse-client.ts)
+# but still only exercised against a live endpoint if this is set -- unset today,
+# per docs/ICEBERG_WRITE_BOUNDARY.md's "not live-verified" note.
+ST0RE_URL=
+
+# ---------------------------------------------------------------------------
+# Payments (wired in code today: app/api/payments/*, app/api/webhooks/stripe)
+# ---------------------------------------------------------------------------
+STRIPE_SECRET_KEY=
+STRIPE_WEBHOOK_SECRET=
+# Documented target (docs/08); not yet read by any route in this pass.
+NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
+
+# ---------------------------------------------------------------------------
+# File storage — Cloudflare R2 (wired in code today: R2_ACCESS_KEY_ID/R2_BUCKET/
+# R2_ENDPOINT are read; R2_ACCOUNT_ID and R2_SECRET_ACCESS_KEY are documented in
+# docs/08 but not found via a process.env.* read in this pass -- verify before
+# assuming the R2 client is fully wired.)
+R2_ACCOUNT_ID=
+R2_ACCESS_KEY_ID=
+R2_SECRET_ACCESS_KEY=
+R2_BUCKET=
+R2_ENDPOINT=
+# Fallback local artifact store used when no object storage is configured
+# (src/adapters/local-blob-store.ts). Leave unset in production.
+OPT_LOCAL_BLOB_DIR=
+
+# ---------------------------------------------------------------------------
+# Email — Resend (documented target, docs/08; no Resend call site found in this
+# pass -- treat as not-yet-implemented, not just unconfigured)
+# ---------------------------------------------------------------------------
+RESEND_API_KEY=
+
+# ---------------------------------------------------------------------------
+# Embedded analytics (documented target, docs/08; no call site found in this pass)
+# ---------------------------------------------------------------------------
+METABASE_SITE_URL=
+METABASE_SECRET_KEY=
+NOCODB_BASE_URL=
+NOCODB_API_TOKEN=
+
+# ---------------------------------------------------------------------------
+# Document intelligence / OCR (wired in code today: src/services/document-extraction-service.ts)
+# ---------------------------------------------------------------------------
+DOC_INTELLIGENCE_ENDPOINT=
+DOC_INTELLIGENCE_KEY=
+DOC_INTELLIGENCE_API_VERSION=
+
+# ---------------------------------------------------------------------------
+# Customer DB-grant encryption (wired in code today: connections/db-grant flow)
+# ---------------------------------------------------------------------------
+# 32-byte key, AES-GCM. Encrypts customer-supplied read-only connection strings at rest.
+GRANT_ENC_KEY=
+
+# ---------------------------------------------------------------------------
+# Misc / public
+# ---------------------------------------------------------------------------
+NEXT_PUBLIC_APP_URL=https://0pt.app
+# Documented target (docs/08); no call site found reading it in this pass.
+NEXT_PUBLIC_API_URL=https://api.0pt.app
+
+# ---------------------------------------------------------------------------
+# Cache / queue (wired in code today: app/api/health only checks presence;
+# no other call site found reading it in this pass -- worker queue usage, if
+# any, lives in services/api, outside this repo's scope)
+# ---------------------------------------------------------------------------
+REDIS_URL=

.gitignore

@@ -18,6 +18,7 @@ yarn-error.log*
 
 # env files
 .env*
+!.env.example
 
 # vercel
 .vercel