Initial commit: site monorepo with API, web, and infra.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/.env.production.example

@@ -0,0 +1,22 @@
+# Production API environment (non-secret keys). Secrets live in data/secrets/install.env
+APP_ENV=production
+ENABLE_DOCS=false
+ENABLE_TEST_ROUTES=false
+COOKIE_SECURE=true
+ENABLE_RATE_LIMIT=true
+EMAIL_DELIVERY_MODE=smtp
+SEED_DEMO_USERS=false
+JWT_ACCESS_TTL_MIN=15
+JWT_REFRESH_TTL_DAYS=30
+STORAGE_MODE=s3
+S3_BUCKET=compton
+S3_REGION=us-east-1
+AVATAR_MAX_BYTES=2097152
+MEDIA_URL_TTL_SECONDS=600
+LOG_LEVEL=INFO
+AUDIT_RETENTION_DAYS=90
+COMPTON_SETTINGS_PATH=data/compton_settings.json
+ADMIN_AUDIT_LOG_PATH=data/logs/admin-audit.jsonl
+SERVER_LOG_PATH=data/logs/server.log
+PASSWORD_DENYLIST_PATH=data/security/password-denylist.txt
+# Set on server: FRONTEND_URL, PUBLIC_BASE_URL, CORS_ORIGINS, SMTP_*, DATABASE_URL (via install.env)