Harden control plane boundaries

.env.example

@@ -1,9 +1,17 @@
-# GEMINI_API_KEY: Required for Gemini AI API calls.
-# AI Studio automatically injects this at runtime from user secrets.
-# Users configure this via the Secrets panel in the AI Studio UI.
-GEMINI_API_KEY="MY_GEMINI_API_KEY"
+HOST="127.0.0.1"
+PORT="3000"
+TRUST_PROXY="loopback"
 
-# APP_URL: The URL where this applet is hosted.
-# AI Studio automatically injects this at runtime with the Cloud Run service URL.
-# Used for self-referential links, OAuth callbacks, and API endpoints.
-APP_URL="MY_APP_URL"
+# Gitea discovery is disabled unless all three values are configured.
+GITEA_BASE_URL="https://git.example.internal"
+GITEA_ALLOWED_ORIGINS="https://git.example.internal"
+GITEA_TOKEN="replace-with-a-read-only-gitea-token"
+GITEA_DISCOVERY_TIMEOUT_MS="5000"
+GITEA_DISCOVERY_RATE_LIMIT="5"
+GITEA_DISCOVERY_RATE_WINDOW_MS="60000"
+
+# Hosts accepted by Git connectivity and synchronization endpoints.
+GIT_ALLOWED_HOSTS="git.example.internal"
+
+# Optional path-delimited roots for local development repositories.
+GIT_ALLOWED_LOCAL_ROOTS="."