fix(dev-env): complete local startup configuration

.env.example

@@ -17,6 +17,8 @@ POSTGRES_PASSWORD=changeme_super
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=changeme_minio_root
 MINIO_ENDPOINT=minio:9000
+# Browser-resolvable endpoint used in presigned URLs.
+MINIO_PUBLIC_ENDPOINT=localhost:9000
 # App-level access key. docker-compose.yml provisions this user and a bucket-scoped policy.
 MINIO_ACCESS_KEY=docuvault_app
 MINIO_SECRET_KEY=changeme_minio_app
@@ -74,3 +76,19 @@ ONEDRIVE_TENANT_ID=common
 # Backend and frontend URLs — used to construct OAuth callback/redirect URLs
 BACKEND_URL=http://localhost:8000
 FRONTEND_URL=http://localhost:5173
+
+# ── AI Defaults ──────────────────────────────────────────────────────────────
+DEFAULT_AI_PROVIDER=ollama
+DEFAULT_AI_MODEL=llama3.2
+SYSTEM_PROMPT=
+
+# ── Auth/session durations ───────────────────────────────────────────────────
+ACCESS_TOKEN_EXPIRE_MINUTES=15
+REFRESH_TOKEN_EXPIRE_DAYS=30
+REFRESH_TOKEN_EXPIRE_HOURS=16
+
+# ── Development logging and observability ────────────────────────────────────
+LOG_LEVEL=INFO
+LOG_JSON=true
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=CHANGEME-replace-with-strong-password

AGENTS.md

@@ -129,6 +129,13 @@ Phase 12 gap-closure: migration-gated Compose startup (migrate service, service_
 
 ## Development Setup
 
+### Local environment contract
+
+- The repository-root `.env` is the complete local-development configuration and must remain excluded from Git.
+- Codex and Claude must update both `.env` and `.env.example` whenever a change adds, removes, or renames an environment variable required by the app or Docker Compose.
+- Preserve existing local secret values unless rotation is required; never copy `.env` secrets into tracked files, logs, commits, or responses.
+- Before declaring startup work complete, run `docker compose config --quiet` and verify every required variable is present and non-empty.
+
 ```bash
 # Start all services
 docker compose up

CLAUDE.md

@@ -125,6 +125,13 @@ All phases are marked complete in `.planning/ROADMAP.md`. The app is functional
 
 ## Development Setup
 
+### Local environment contract
+
+- The repository-root `.env` is the complete local-development configuration and must remain excluded from Git.
+- Codex and Claude must update both `.env` and `.env.example` whenever a change adds, removes, or renames an environment variable required by the app or Docker Compose.
+- Preserve existing local secret values unless rotation is required; never copy `.env` secrets into tracked files, logs, commits, or responses.
+- Before declaring startup work complete, run `docker compose config --quiet` and verify every required variable is present and non-empty.
+
 ```bash
 # Start all services
 docker compose up