enable dev|prod envs with simpler env vars system

proxy/src/env.ts

@@ -0,0 +1,14 @@
+// Runtime env for the proxy. Same dev/prod split as the frontend: dev connects
+// to the dev machine's PocketBase at SERVER_IP, prod connects to the
+// container-internal loopback PB. Ports come from config.ts (single source).
+//
+// Env loading: dev uses `tsx --env-file=../.env` (see package.json) like vite
+// does for the frontend; prod (docker) injects env via compose and has no .env,
+// so SERVER_IP is unset → loopback below.
+const SERVER_IP = process.env.SERVER_IP;
+
+export const PB_ENDPOINT = SERVER_IP
+  ? `http://${SERVER_IP}:8090`
+  : `http://127.0.0.1:8090`;
+export const PB_EMAIL = process.env.PB_EMAIL || "debug@famchamp.dev";
+export const PB_PASSWORD = process.env.PB_PASSWORD || "debug123";

proxy/src/index.ts

@@ -3,6 +3,7 @@ import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { pb } from "./pb.ts";
 import { migrate } from "./migrate.ts";
+import { PROXY_PORT } from "../../config.ts";
 import {
   weekStart as tzWeekStart,
   addDaysStr,
@@ -2453,11 +2454,10 @@ app.get("/api/chat/me", async (c) => {
 
 // ── Start server ─────────────────────────────────────────
 
-const port = parseInt(process.env.PROXY_PORT || "3456", 10);
-const SERVER_IP = "192.168.1.225";
+const port = parseInt(process.env.PROXY_PORT || PROXY_PORT, 10);
 
 serve({ fetch: app.fetch, port }, async (info) => {
-  console.log(`Hono proxy listening on ${SERVER_IP}:${info.port}`);
+  console.log(`Hono proxy listening on 0.0.0.0:${info.port}`);
   try {
     await migrate();
   } catch (e) {

proxy/src/migrate.ts

@@ -128,6 +128,8 @@ async function ensureSchema(): Promise<void> {
       jsonField("seasons"),
     ]),
   ))!;
+  // fams is sensitive → superadmin-only (proxy/server reads). Not public.
+  await updateCollection(famsId, { viewRule: null, listRule: null });
   await createCollection(
     colDef("bonus_templates", [
       rel("famId", famsId, true),
@@ -280,6 +282,20 @@ export async function migrate(): Promise<void> {
 
   await ensureSchema();
 
+  // ── 0. Lock fams to superadmin-only (sensitive; read via proxy/server) ──
+  {
+    const famsCol = await getCollection("fams");
+    if (famsCol) {
+      const rules = { viewRule: null, listRule: null };
+      if (famsCol.viewRule !== null || famsCol.listRule !== null) {
+        console.log("[migrate] Locking fams collection to superadmin-only...");
+        await updateCollection(famsCol.id, rules);
+      } else {
+        console.log("  ↳ fams already superadmin-only");
+      }
+    }
+  }
+
   // ── 1. Create bonus_configs if missing ──
   const existing = await getCollection("bonus_configs");
   if (!existing) {