Merge branch 'feature/deployment'

ARCHITECTURE.md

@@ -286,21 +286,22 @@ Real-time right-slideout chat panel (TopNav chat icon, slideout on desktop / ful
 
 ## 7. Environment Variables
 
-### Frontend + Hono container
+### Current (this repo)
 ```
-PUBLIC_PB_URL=https://pb.chores.app.com
-PB_ADMIN_EMAIL=admin@chores.app
-PB_ADMIN_PASSWORD=<super-admin-password>
-STRIPE_SECRET_KEY=sk_live_xxx
-STRIPE_WEBHOOK_SECRET=whsec_xxx
-DONATION_MODAL_INTERVAL=30
+# .env (dev; loaded by vite for the frontend + tsx --env-file for the proxy)
+PB_EMAIL=debug@famchamp.dev        # PB superuser (server-only; pb-admin + proxy)
+PB_PASSWORD=debug123
+SERVER_IP=192.168.1.225            # dev machine IP (Tailscale IP when away) — change when it changes
 ```
+- Ports live in root `config.ts` (`FRONTEND_PORT`/`PROXY_PORT`/`PB_PORT` = `2080`/`3456`/`8090`) — the proxy reads them; SvelteKit never imports `config.ts`.
+- SvelteKit env vars are declared in `frontend/src/env.ts` (`PROXY_URL`, `SERVER_IP`, `PB_EMAIL`, `PB_PASSWORD`) and read via `$app/env/public` / `$app/env/private`.
+- Compose/deploy: `PORT` (public port, default `3001`), `PB_DATA` (host data dir). `PUBLIC_PB_URL` no longer exists (docker bakes `/pb`; browser PB URL derives from `SERVER_IP` in dev).
+- Not yet wired: `STRIPE_SECRET_KEY`, `DONATION_MODAL_INTERVAL`.
 
-### PocketBase container
-```
-PB_SUPERUSER_EMAIL=you@email.com
-PB_SUPERUSER_PASSWORD=<your-password>
-```
+### Dev vs Prod PocketBase data (⚠️)
+- **Dev (`pnpm dev`)**: permanent dev PB = container **`pb-dev`** at `:8090`, data in host `./pb_data`. This is what the code talks to via `SERVER_IP:8090`.
+- **Prod/docker**: the app container bundles its **own internal PB**, published loopback-only at `127.0.0.1:8091`, and also bind-mounts `./pb_data`.
+- Never recreate `pb-dev` with a fresh volume — restore it with `-v "$PWD/pb_data:/pb_data"` (full command in `RULES.md`).
 
 ---