feat: harden community production foundation through story 1.5

.env.example

@@ -1,46 +1,34 @@
-POSTGRES_DB=crank
-POSTGRES_USER=crank
-POSTGRES_PASSWORD=change-me
+# Deployment-only image and publication settings.
+CRANK_ADMIN_API_IMAGE=crank/admin-api:dev
+CRANK_MCP_SERVER_IMAGE=crank/mcp-server:dev
+CRANK_UI_IMAGE=crank/ui:dev
+CRANK_PUBLISH_BIND=127.0.0.1
+
+# BEGIN GENERATED CRANK RUNTIME CONFIG
+CRANK_DATABASE_URL=
 POSTGRES_HOST=postgres
 POSTGRES_PORT=5432
+POSTGRES_DB=crank
+POSTGRES_USER=crank
+POSTGRES_PASSWORD=
 POSTGRES_MAX_CONNECTIONS=20
 POSTGRES_MIN_CONNECTIONS=2
 POSTGRES_ACQUIRE_TIMEOUT_MS=5000
 POSTGRES_IDLE_TIMEOUT_MS=600000
 POSTGRES_MAX_LIFETIME_MS=1800000
-CRANK_ADMIN_API_IMAGE=crank/admin-api:dev
-CRANK_MCP_SERVER_IMAGE=crank/mcp-server:dev
-CRANK_UI_IMAGE=crank/ui:dev
-CRANK_STORAGE_ROOT=/var/lib/crank/storage
-CRANK_PUBLISH_BIND=127.0.0.1
-CRANK_ADMIN_BIND=0.0.0.0:3001
-CRANK_ADMIN_RATE_LIMIT_RPS=30
-CRANK_ADMIN_RATE_LIMIT_BURST=60
-CRANK_MCP_BIND=0.0.0.0:3002
-CRANK_MCP_REFRESH_MS=5000
-CRANK_MCP_RATE_LIMIT_RPS=60
-CRANK_MCP_RATE_LIMIT_BURST=120
+CRANK_MASTER_KEY=
+CRANK_BASE_URL=http://localhost:3000
 CRANK_RUNTIME_MAX_CONCURRENT_UNARY=64
-CRANK_RUNTIME_MAX_CONCURRENT_WINDOW=16
-CRANK_RUNTIME_MAX_CONCURRENT_SESSIONS=16
-CRANK_RUNTIME_MAX_CONCURRENT_JOBS=16
-# Публичные узлы разрешены по умолчанию. Для внутренних API перечислите
-# допустимые имена или IP через запятую.
+CRANK_CACHE_BACKEND=memory
+CRANK_CACHE_URL=
 CRANK_OUTBOUND_ALLOWED_HOSTS=
 CRANK_OUTBOUND_DENIED_HOSTS=
 CRANK_OUTBOUND_MAX_RESPONSE_BYTES=4194304
 CRANK_ENVIRONMENT=development
-CRANK_LOG_LEVEL=info
-# Пустое значение отключает канал критических ошибок.
+CRANK_LOG_LEVEL=
 CRANK_SENTRY_DSN=
-# Prometheus endpoints use separate listeners and stay on loopback by default.
 CRANK_METRICS_ENABLED=true
-CRANK_ADMIN_METRICS_BIND=127.0.0.1:9464
-CRANK_MCP_METRICS_BIND=127.0.0.1:9465
-# Required when either metrics listener uses a non-loopback address.
 CRANK_METRICS_BEARER_TOKEN=
-CRANK_INVOCATION_LOG_RETENTION_DAYS=30
-# Пустой endpoint полностью отключает экспорт трасс.
 OTEL_EXPORTER_OTLP_ENDPOINT=
 OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=
 OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
@@ -53,15 +41,24 @@ OTEL_BSP_MAX_QUEUE_SIZE=2048
 OTEL_BSP_MAX_EXPORT_BATCH_SIZE=512
 OTEL_BSP_SCHEDULE_DELAY=5000
 OTEL_BSP_EXPORT_TIMEOUT=30000
-CRANK_MASTER_KEY=change-me-master-key
-CRANK_SESSION_SECRET=change-me-session-secret
-CRANK_PASSWORD_PEPPER=change-me-password-pepper
+CRANK_ADMIN_BIND=0.0.0.0:3001
+CRANK_ADMIN_METRICS_BIND=127.0.0.1:9464
+CRANK_STORAGE_ROOT=/var/lib/crank/storage
+CRANK_ADMIN_RATE_LIMIT_RPS=30
+CRANK_ADMIN_RATE_LIMIT_BURST=60
+CRANK_INVOCATION_LOG_RETENTION_DAYS=30
+CRANK_SESSION_SECRET=
+CRANK_PASSWORD_PEPPER=
 CRANK_SESSION_TTL_HOURS=24
-# Trust X-Real-IP / X-Forwarded-For for client rate limiting. Enable only when
-# admin-api runs behind the bundled nginx (or another trusted reverse proxy).
-CRANK_TRUST_FORWARDED_HEADERS=true
-CRANK_BOOTSTRAP_ADMIN_EMAIL=owner@crank.local
-CRANK_BOOTSTRAP_ADMIN_PASSWORD=change-me-admin-password
+CRANK_TRUST_FORWARDED_HEADERS=false
+CRANK_BOOTSTRAP_ADMIN_EMAIL=
+CRANK_BOOTSTRAP_ADMIN_PASSWORD=
 CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME=Crank Owner
-CRANK_DEMO_SEED=true
-CRANK_BASE_URL=https://crank.example.com
+CRANK_DEMO_SEED=false
+CRANK_MCP_BIND=0.0.0.0:3002
+CRANK_MCP_METRICS_BIND=127.0.0.1:9465
+CRANK_MCP_REFRESH_MS=5000
+CRANK_MCP_RATE_LIMIT_RPS=60
+CRANK_MCP_RATE_LIMIT_BURST=120
+CRANK_RUNTIME_MAX_CONCURRENT_SESSIONS=16
+# END GENERATED CRANK RUNTIME CONFIG