Key vars (see .env.example): DATABASE_URL PostgreSQL · NEXT_PUBLIC_API_URL tRPC endpoint for frontend · AI_PROVIDER/AI_MODEL/AI_API_KEY LLM config · GOOGLE_CLIENT_ID/CLIENT_SECRET/REDIRECT_URI OAuth · TOKEN_ENCRYPTION_KEY 64 hex chars, AES-GCM, every secret at rest (ex-GOOGLE_-prefixed, #545) · S3_ENDPOINT object storage · OTEL_EXPORTER_OTLP_ENDPOINT tracing · PORTAL_JWT_SECRET portal auth token secret · TEMPORAL_ADDRESS Temporal server.