enable dev|prod envs with simpler env vars system

proxy/src/migrate.ts

@@ -128,6 +128,8 @@ async function ensureSchema(): Promise<void> {
       jsonField("seasons"),
     ]),
   ))!;
+  // fams is sensitive → superadmin-only (proxy/server reads). Not public.
+  await updateCollection(famsId, { viewRule: null, listRule: null });
   await createCollection(
     colDef("bonus_templates", [
       rel("famId", famsId, true),
@@ -280,6 +282,20 @@ export async function migrate(): Promise<void> {
 
   await ensureSchema();
 
+  // ── 0. Lock fams to superadmin-only (sensitive; read via proxy/server) ──
+  {
+    const famsCol = await getCollection("fams");
+    if (famsCol) {
+      const rules = { viewRule: null, listRule: null };
+      if (famsCol.viewRule !== null || famsCol.listRule !== null) {
+        console.log("[migrate] Locking fams collection to superadmin-only...");
+        await updateCollection(famsCol.id, rules);
+      } else {
+        console.log("  ↳ fams already superadmin-only");
+      }
+    }
+  }
+
   // ── 1. Create bonus_configs if missing ──
   const existing = await getCollection("bonus_configs");
   if (!existing) {