--- a/mrjunejune/.config.development	Thu Aug 06 11:31:30 2026 -0700
+++ b/mrjunejune/.config.development	Fri Aug 07 07:34:12 2026 -0700
@@ -1,12 +1,106 @@
-# MrJuneJune Server Configuration
-
+# MrJuneJune Server Configuration — DEVELOPMENT TEMPLATE
+#
+# This file is a copyable filler only.  It contains no real secrets, hashes,
+# or credentials.  Copy it to .config (which is VCS-ignored) and fill in your
+# local values before starting the server.
+#
+#   cp mrjunejune/.config.development mrjunejune/.config
+#
+# ─────────────────────────────────────────────────────────────────────────────
 # Auth token for S3 upload API
-# Client must send this in Authorization header: Bearer <token>
-UPLOAD_AUTH_TOKEN=THIS
+# Client must send: Authorization: Bearer <token>
+UPLOAD_AUTH_TOKEN=REPLACE_WITH_LOCAL_TOKEN
 
 # S3 Configuration
-S3_REGION=THIS
-S3_BUCKET=THIS
+S3_REGION=REPLACE_WITH_REGION
+S3_BUCKET=REPLACE_WITH_BUCKET
 
 # Presigned URL expiration (seconds)
-S3_URL_EXPIRES=SECONDS
+S3_URL_EXPIRES=3600
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Auth — all AUTH_* values may also be set as environment variables; env takes
+# precedence over this file.  Never commit real values here.
+#
+# AUTH_COOKIE_SECRET
+#   A cryptographically random 32-byte secret encoded as a lowercase hex string
+#   (64 hex chars).  Used to sign session and guest cookies via HMAC-SHA-256.
+#   Generate with:
+#     openssl rand -hex 32
+#   Minimum: 64 hex chars (32 bytes).  Maximum: 2048 hex chars (1024 bytes).
+AUTH_COOKIE_SECRET=REPLACE_WITH_OUTPUT_OF_openssl_rand_hex_32
+
+# AUTH_BOOTSTRAP_USERNAME / AUTH_BOOTSTRAP_PASSWORD_HASH
+#   Creates the initial admin account on first startup if no admin exists yet.
+#   Both must be set together, or both must be absent.
+#   Generate the hash with:
+#     bazel run //auth:hash_password
+#   Then enter the desired bootstrap password at the prompt.
+#   Example format (do not use this value — it is a public test fixture):
+#     zenbu-scrypt$v=1$N=32768$r=8$p=1$<salt>$<hash>
+AUTH_BOOTSTRAP_USERNAME=admin
+AUTH_BOOTSTRAP_PASSWORD_HASH=REPLACE_WITH_OUTPUT_OF_bazel_run_//auth:hash_password
+
+# AUTH_TRUSTED_PROXY
+#   Exact direct-peer IP address of your reverse proxy (e.g. nginx/Caddy).
+#   When set, the server trusts X-Real-IP from this peer for client-IP binding.
+#   Leave commented out if the server receives direct connections.
+#   Must be a valid IPv4 or IPv6 address.
+# AUTH_TRUSTED_PROXY=10.0.0.1
+
+# AUTH_SESSION_IDLE_TTL / AUTH_SESSION_ABS_TTL
+#   Idle TTL: seconds since last request before a session expires (default 7 d).
+#   Abs TTL: absolute session lifetime regardless of activity (default 30 d).
+#   Idle must not exceed Abs.  Both must be 60–31536000.
+# AUTH_SESSION_IDLE_TTL=604800
+# AUTH_SESSION_ABS_TTL=2592000
+
+# AUTH_GUEST_TTL
+#   Lifetime of a guest identity record in seconds (default 30 d).
+# AUTH_GUEST_TTL=2592000
+
+# AUTH_DEV_INSECURE_COOKIE
+#   Set to true to issue cookies without the Secure attribute.
+#   ONLY valid when SERVER_HOST is a loopback address (127.0.0.1, ::1, or localhost).
+#   Must NOT be set in production or on a non-loopback bind.
+AUTH_DEV_INSECURE_COOKIE=true
+
+# ─────────────────────────────────────────────────────────────────────────────
+# SERVER_HOST
+#   IP address the server listens on.  Defaults to 0.0.0.0 (all interfaces).
+#   For local development, set to 127.0.0.1 — required when
+#   AUTH_DEV_INSECURE_COOKIE=true.
+#   In production, either leave unset (0.0.0.0) or set to a specific interface.
+SERVER_HOST=127.0.0.1
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Guest inference quota — enable guest inference at runtime via the environment:
+#   MRJUNEJUNE_ALLOW_GUEST_INFERENCE=1
+# These integer values control per-guest rate limits.
+# Malformed or out-of-range values cause startup failure.
+# AUTH_GUEST_DAILY_TURNS=10
+# AUTH_GUEST_DAILY_OUTPUT_TOKENS=20000
+# AUTH_GUEST_REQUEST_OUTPUT_TOKENS=2048
+
+# ─────────────────────────────────────────────────────────────────────────────
+# OPERATIONAL NOTES
+#
+# Bootstrap password rotation:
+#   After the bootstrap admin logs in for the first time, change the password
+#   via the /account/password page.  To rotate the bootstrap credential itself:
+#   1. Generate a new hash:  bazel run //auth:hash_password
+#   2. Update AUTH_BOOTSTRAP_PASSWORD_HASH in .config.
+#   3. Use Admin_API or SQL to reset the stored hash for the admin user.
+#      (Bootstrap only creates the user on first startup when no admin exists.)
+#
+# Guest data retention:
+#   Guest identity rows accumulate in the auth SQLite database.  Rows expire
+#   after AUTH_GUEST_TTL seconds from last activity.  Auth_Store automatically
+#   skips expired rows on reads; periodic cleanup of very old rows can be done
+#   with: DELETE FROM guest_identities WHERE expires_at < strftime('%s','now');
+#   Run this against the auth database (DB_PATH, default mrjunejune/data/).
+#
+# Secure cookie policy:
+#   Production deployments must NOT set AUTH_DEV_INSECURE_COOKIE=true.
+#   Ensure your reverse proxy terminates TLS and forwards via SERVER_HOST.
+#   The Secure cookie attribute is enforced automatically on non-loopback hosts.