Harden authz/XSS/entitlements and restyle to Google Developers UI

.env.example

@@ -1,52 +1,86 @@
-CATALYST_WEBHOOK_URL=
-DODOPAY_API_KEY=
-DODOPAY_SANDBOX_MODE=
-DODOPAY_WEBHOOK_SECRET=
-MAILGUN_API_KEY=
-MAILGUN_DOMAIN=
-MAILGUN_FROM_EMAIL=
-MAILGUN_FROM_NAME=
-MAILGUN_HOST=
-MONGODB_DB_NAME=
-MONGODB_URI=
-NEXTAUTH_SECRET=
-NEXTAUTH_URL=
-PAGESPEED_API_KEY=
-UPSTASH_REDIS_REST_TOKEN=
-UPSTASH_REDIS_REST_URL=
-V2CHECKOUT_MERCHANT_CODE=
-V2CHECKOUT_SANDBOX_MODE=
-V2CHECKOUT_SECRET_KEY=
-VITE_APP_URL=
-VITE_ENABLE_ANALYTICS=
-VITE_ENABLE_PERFORMANCE_MONITORING=
-VITE_FIREBASE_API_KEY=
-VITE_FIREBASE_APP_ID=
-VITE_FIREBASE_AUTH_DOMAIN=
-VITE_FIREBASE_MEASUREMENT_ID=
-VITE_FIREBASE_MESSAGING_SENDER_ID=
-VITE_FIREBASE_PROJECT_ID=
-VITE_FIREBASE_STORAGE_BUCKET=
-
-# --- Phase 0 security hardening -------------------------------------------
-# GitHub webhook HMAC secret (sha256 signatures are verified over the raw body).
-# Configure this in your GitHub repo webhook settings; leave empty to reject
-# all GitHub webhook deliveries.
+# CatalystLab environment template
+# Copy to `.env` for local use:  cp .env.example .env
+# `.env` is gitignored. This file is tracked (see !.env.example in .gitignore).
+# Leave secrets empty in this template. Production must set real values.
+
+# =============================================================================
+# Runtime
+# =============================================================================
+# development | test | production  (production is always default-deny for authz)
+NODE_ENV=development
+# HTTP listen address. Use 0.0.0.0 so the preview proxy can reach the server.
+HOST=0.0.0.0
+PORT=3000
+# pino log level: fatal | error | warn | info | debug | trace
+LOG_LEVEL=info
+
+# =============================================================================
+# Reverse proxy / client IP
+# =============================================================================
+# Set to "true" ONLY when Express sits behind a trusted proxy (Cloud Run, nginx).
+# When unset, X-Forwarded-For / CF-Connecting-IP are ignored for rate limits,
+# client-log buckets, and telemetry geo hashing.
+TRUST_PROXY=
+
+# =============================================================================
+# Auth / demo surfaces
+# =============================================================================
+# Skip Firebase identity on GitHub/notifications/API-key demo routes.
+# Honored ONLY when NODE_ENV=test (vitest). Ignored in development and production.
+ALLOW_UNAUTH_DEMO=
+
+# Firebase Admin — server-side ID token verification (attachIdentity, state sync).
+# Unset => requests with Bearer tokens fail closed (401); anonymous stay visitors.
+# Inline JSON (raw or base64) takes precedence over a file path.
+FIREBASE_SERVICE_ACCOUNT_JSON=
+FIREBASE_SERVICE_ACCOUNT_PATH=
+# Standard Google ADC path (used if FIREBASE_SERVICE_ACCOUNT_PATH is empty).
+GOOGLE_APPLICATION_CREDENTIALS=
+
+# Comma-separated allowlist of cat_live_... keys accepted via the x-api-key header.
+# Unset => API-key rate tier is disabled (fail closed). Never put keys in Authorization: Bearer.
+VALID_API_KEYS=
+
+# =============================================================================
+# Webhooks (HMAC over the raw request body)
+# =============================================================================
+# GitHub repo webhook secret. Empty => unsigned deliveries are rejected.
 GITHUB_WEBHOOK_SECRET=
 
-# Webhook signing secrets for payment gateways (HMAC-SHA256 over raw body).
-# Per-gateway value wins over the shared value; unset => deliveries rejected (503).
+# Shared payment webhook secret. Per-gateway vars below override this.
 PAYMENTS_WEBHOOK_SECRET=
 PAYMENTS_WEBHOOK_SECRET_2CHECKOUT=
 PAYMENTS_WEBHOOK_SECRET_DODOPAY=
 
-# Comma-separated allowlist of valid ``cat_live_...`` API keys. Unset => the
-# API-key rate tier is disabled entirely (Phase 1 replaces this with hashed,
-# persisted keys).
-VALID_API_KEYS=
+# =============================================================================
+# Payments (fail closed — missing credentials => 503, no fake checkout)
+# =============================================================================
+V2CHECKOUT_MERCHANT_CODE=
+V2CHECKOUT_SECRET_KEY=
+# "false" = live 2Checkout URLs; any other value = sandbox
+V2CHECKOUT_SANDBOX_MODE=
 
-# Firebase Admin service account for server-side ID token verification
-# (state sync auth). Either inline JSON (optionally base64) or a file path.
-# Unset => /api/state/sync responds 401 to everyone (fail closed).
-FIREBASE_SERVICE_ACCOUNT_JSON=
-FIREBASE_SERVICE_ACCOUNT_PATH=
+DODOPAY_API_KEY=
+DODOPAY_WEBHOOK_SECRET=
+# "false" = live Dodo URLs; any other value = sandbox
+DODOPAY_SANDBOX_MODE=
+
+# =============================================================================
+# Rate limiting (optional distributed limiter)
+# =============================================================================
+# When both are set, engine routes also consume an Upstash sliding window (120/min).
+# Unset => in-memory limiter only (fine for single instance / tests).
+UPSTASH_REDIS_REST_URL=
+UPSTASH_REDIS_REST_TOKEN=
+
+# =============================================================================
+# Analytics / Mailgun (optional)
+# =============================================================================
+MONGODB_URI=
+MONGODB_DB_NAME=
+
+MAILGUN_API_KEY=
+MAILGUN_DOMAIN=
+MAILGUN_FROM_EMAIL=
+MAILGUN_FROM_NAME=
+MAILGUN_HOST=