update

.env.example

@@ -63,6 +63,34 @@ TOKEN_SIGNING_SECRET=
 # openssl rand -hex 32
 APP_ENCRYPTION_KEY=
 
+# --- Production host (uncomment / set on the server; setup --production helps) ---
+# APP_ENV=production
+# SESSION_SECURE=true
+# WEB_ORIGIN=https://descrybe.io
+# PUBLIC_API_URL=https://api.descrybe.io
+# HTTP_ADDR=127.0.0.1:28471
+# TRUSTED_PROXIES=127.0.0.1
+# DATABASE_URL=postgres://descrybe:CHANGE_ME@127.0.0.1:5432/descrybe?sslmode=disable
+# TOKEN_SIGNING_SECRET and APP_ENCRYPTION_KEY: leave empty and run
+#   npm run setup
+# to generate (or: openssl rand -hex 32).
+
+# Platform invite / forgot-password mail (optional env; prefer /admin/settings).
+# EMAIL_DRY_RUN defaults true when unset (safe). Live send needs false + SMTP.
+# EMAIL_DRY_RUN=true
+# SMTP_ENABLED=false
+# SMTP_HOST=
+# SMTP_PORT=587
+# SMTP_USER=
+# SMTP_PASSWORD=
+# SMTP_FROM=noreply@descrybe.io
+
+# Cutover / ops toggles (optional)
+# HYPERCARE_MODE=false
+# STRIPE_MOCK=false
+# MAINTENANCE_MODE=false
+# READ_ONLY_MODE=false
+
 # --- Optional bootstrap (safe defaults in code; uncomment to override) ---
 # TRUSTED_PROXIES - hop-1 reverse-proxy / LB peers only (CIDR or IP, comma-separated).
 # When set, TrustedRealIP rewrites RemoteAddr from X-Forwarded-For / X-Real-IP only if