add auth

.env.example

@@ -9,19 +9,28 @@ MONGO_DB=spsays
 # PostgreSQL (users, relations)
 POSTGRES_URI=postgres://user:pass@localhost:5432/spsays?sslmode=disable
 
-# Meilisearch
-MEILISEARCH_HOST=http://localhost:7700
-MEILISEARCH_API_KEY=
+# Typesense
+TYPESENSE_URL=https://search.prabhupadasays.org
+TYPESENSE_API_KEY=
 
 # DragonflyDB / Redis
 REDIS_URI=redis://localhost:6379
 
-# S3
-S3_REGION=
-S3_BUCKET=
-S3_ACCESS_KEY=
-S3_SECRET_KEY=
-S3_ENDPOINT=
+# Cloudflare R2 (avatar uploads via presigned URLs)
+# R2 endpoint is auto-built as https://<account_id>.r2.cloudflarestorage.com
+R2_ACCOUNT_ID=
+R2_ACCESS_KEY_ID=
+R2_SECRET_ACCESS_KEY=
+R2_BUCKET=
+# Public base URL where bucket objects are served (custom domain or pub-XXX.r2.dev)
+R2_PUBLIC_URL=
+
+# SMTP (password-reset + email-verification)
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USERNAME=
+SMTP_PASSWORD=
+SMTP_FROM="Prabhupāda Says <noreply@prabhupadasays.org>"
 
 # Push Notifications
 FCM_CREDENTIALS_FILE=
@@ -32,7 +41,10 @@ APNS_BUNDLE_ID=
 
 # JWT
 JWT_SECRET=change-me-in-production
-JWT_EXPIRATION=24h
+JWT_EXPIRATION=168h
+# Cookie domain — empty in dev (uses request host), ".prabhupadasays.org" in prod
+COOKIE_DOMAIN=
+COOKIE_SECURE=false
 
-# Frontend
+# Frontend (CORS + email link base)
 FRONTEND_URL=http://localhost:3000