chore(ops): harden deployment and runtime setup

.env.example

@@ -1,11 +1,27 @@
-NEXT_PUBLIC_SITE_URL=http://localhost:3010
+# Public base URL used for canonical URLs, sitemap, robots.txt and absolute metadata.
+# Local example: http://localhost:3010
+# Production example: https://funktechnik-schubert.de
+NEXT_PUBLIC_SITE_URL=
 
-# Admin Foundation
-ADMIN_EMAIL=admin@funktechnik-schubert.local
-ADMIN_PASSWORD=change-me
-ADMIN_SESSION_SECRET=change-me-with-a-long-random-secret
+# Admin login email address. Required for /admin.
+ADMIN_EMAIL=
+
+# Admin login password. Required for /admin.
+# Use a long unique password and never commit a real value.
+ADMIN_PASSWORD=
+
+# Secret for signing the HttpOnly admin session cookie. Required.
+# Use a long random value, for example generated by: openssl rand -base64 48
+ADMIN_SESSION_SECRET=
+
+# Set to true in production behind HTTPS so admin cookies are Secure.
+# Use false only for local HTTP development.
 AUTH_COOKIE_SECURE=false
 
-# Optional spaetere Integration. Nicht im Browser verwenden.
+# Optional future server-side Olympus intake endpoint.
+# Leave empty until the Olympus integration is explicitly implemented.
 OLYMPUS_INTAKE_API_URL=
+
+# Optional future server-side Olympus intake token.
+# Leave empty until the Olympus integration is explicitly implemented.
 OLYMPUS_INTAKE_API_TOKEN=