docs(operations): env-vars runbook + gitignore .env.production.snapshot*

[pulkitpareek18]

Documents the manual VPS env-injection procedure (as it stands today after the SMTP rollout) plus the GitHub-Actions-managed PROD_ENV_FILE path that retires it on the next change.

Why now

Today's SMTP env injection for issue #27 exposed two real procedural gaps:

1. `docker compose restart` does NOT reload `env_file`. It restarts the container with its boot-time env. To pick up edits to the env_file, you MUST `up -d --force-recreate`. We hit this live during the SMTP rollout — env was injected, restart ran clean, but `sendMail()` kept logging "SMTP not configured" until we forced recreate. Caught + corrected; documented + load-bearing in this runbook so it doesn't bite the next operator.
2. Local `.env.production.snapshot` files weren't gitignored. They contain real production credentials. Caught before any commit, but the .gitignore now explicitly covers both the latest (`.env.production.snapshot`) and the per-change archival copies (`.env.production.snapshot.*`).

What's in the runbook

`docs/operations/env-vars.md`:

• 5-location map of where env vars live (VPS .env, local .env, two snapshot files, .env.example) and which is authoritative
• The restart-vs-recreate gotcha at the top, called out clearly
• Step-by-step procedures:
  • Add or change one or more env vars (snapshot → edit → recreate → verify → sync)
  • Rotate a secret (with the "new before old" ordering rule)
  • Emergency rollback (from `.env.bak.` backups, ~30 seconds)
  • Full re-creation from local snapshot if the VPS `.env` is lost
• Service-specific operational pre-reqs: Brevo IP allowlist, SPF/DKIM/DMARC DNS for inbox delivery, Postgres password rotation order, DIDRegistry transferOwnership ordering on blockchain wallet rotation
• The plan to retire manual editing — the `PROD_ENV_FILE` GitHub secret path. Backwards-compatible (guarded by `if: env.PROD_ENV_FILE != ''`) so today's manual flow keeps working until the secret is added in GH UI.
• Audit-log table at the bottom. Every production env change adds a row. First entry: today's SMTP injection.

Test plan

• All snapshots gitignored (`git check-ignore .env.production.snapshot[.]` → 0)
• No secrets in any tracked file (`git diff` filtered for known credential strings → 0 hits)
• Production SMTP working end-to-end (verified via fresh-signup + duplicate-signup; both `Email: sent` with messageIds)

🤖 Generated with Claude Code