fix: make .env.example a dev template, link production to .env.production.example (#260)

[aditya226-sharma]

Summary

Replaces the production-flavoured .env.example with a dev-focused template and adds a production reference in the README quick start.

Changes

• Rewrote .env.example with dev values (NODE_ENV=development, HIGHFIVE_API_KEY=dev-secret-key, DEBUG=true, DUCKDB_SERVICE_URL)
• Added reference to .env.production.example in README quick start section

Why

The existing .env.example was a production template (HIGHFIVE_API_KEY=your_secure_production_key_here, NODE_ENV=production) but the README quick start told contributors to copy it for dev. This caused silent issues:

• The placeholder string became the admin login password
• Required dev variables (DEBUG, DUCKDB_SERVICE_URL) were missing
• A separate .env.production.example already existed

Closes #260

[cofade]

Thanks for taking this on — the diagnosis in the description is right, and adding a production pointer to the README is a good instinct. Closing this one in favour of #264, which was opened a day earlier for the same issue and also updates the four docs that restate the .env. For the record, three things in this diff would have needed to change before it could merge:

• DUCKDB_SERVICE_URL=http://localhost:5001 reaches the image-service container. docker-compose.yml loads .env via env_file for image-service and its environment: block does not override that variable, so every /image_uploads write would go to localhost:5001 inside the container. The service is duckdb-service:8000 in-compose and 8002 on the host; nothing listens on 5001. That breaks the cp .env.example .env && docker compose up path the README describes, and CLAUDE.md rules out localhost in inter-service URLs.
• HIGHFIVE_API_KEY=dev-secret-key recreates what onboarding: .env.example is a production template that README's dev quick start copies into the dev compose stack; three docs describe three different dev .env files #260 describes: a committed placeholder becomes the admin password of every dev box. Leaving it unset lets the backend's NODE_ENV=development fallback apply (backend/src/auth.ts).
• Smaller: PORT=3001 is stale (the backend is 3002), VITE_API_URL and NODE_ENV never reach anything (homepage has no env_file; Vite reads homepage/.env), and the production link should go to production-deployment.md — the PM2 runbook's own header marks it as the non-recommended path.

The README production pointer is worth keeping; I have suggested it on #264.

🤖 Generated with Claude Code