fix: sellable-product audit + Wave A/B contract repair

.env.example

@@ -15,8 +15,7 @@ FLASK_ENV=development
 
 # ── Database ─────────────────────────────────────────────
 # Local dev (SQLite): leave DATABASE_URL unset; DATABASE_PATH is used instead.
-# Production (Railway/Supabase): set DATABASE_URL to a postgresql:// connection string.
-# Railway auto-injects DATABASE_URL if you add the Postgres plugin.
+# Production (Vercel + Supabase): set DATABASE_URL to the Supabase pooler URL.
 # DATABASE_URL=postgresql://user:password@host:5432/dbname?sslmode=require
 DATABASE_PATH=postpilot.db
 
@@ -28,30 +27,34 @@ SUPABASE_SERVICE_ROLE_KEY=eyJ...
 # Service role key is used server-side only — never expose to the browser.
 
 # ── Redis (REQUIRED in production for rate limiting) ─────
-# Without this, each gunicorn worker has its own rate-limit counter.
+# Without this, each serverless instance has its own rate-limit counter.
 # Local dev: leave commented out (falls back to memory://).
-# Railway: add the Redis plugin and it auto-injects REDIS_URL.
+# Production: Upstash Redis URL in Vercel env vars.
 # REDIS_URL=redis://default:<password>@<host>:<port>
 
 # ── OpenAI (required for AI caption generation) ─────────
 OPENAI_API_KEY=sk-...
 
 # ── Stripe (required for billing) ───────────────────────
+# Tiers: Free / Starter / Pro / Agency (no Growth tier)
 STRIPE_SECRET_KEY=sk_live_...
 STRIPE_WEBHOOK_SECRET=whsec_...
-STRIPE_PRICE_STARTER=price_...
-STRIPE_PRICE_GROWTH=price_...
-STRIPE_PRICE_AGENCY=price_...
+STRIPE_PRICE_STARTER_MONTHLY=price_...
+STRIPE_PRICE_STARTER_ANNUAL=price_...
+STRIPE_PRICE_PRO_MONTHLY=price_...
+STRIPE_PRICE_PRO_ANNUAL=price_...
+STRIPE_PRICE_AGENCY_MONTHLY=price_...
+STRIPE_PRICE_AGENCY_ANNUAL=price_...
 
 # ── Sentry (optional — error monitoring) ─────────────────
-# Leave blank in dev to disable. Set in production for error tracking.
+# Leave blank in dev to disable. Set in Vercel production.
 # SENTRY_DSN=https://xxx@o0.ingest.sentry.io/xxx
 
 # ── Cron jobs (REQUIRED in production) ───────────────────
-# A secret token used to authenticate scheduled cron endpoint calls.
-# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
-# Set the same value in your Railway environment variables.
-CRON_SECRET=change-me-to-a-random-hex-string
+# Authenticates Vercel Cron calls to /api/cron/*
+# Generate with: python -c "import secrets; print(secrets.token_urlsafe(32))"
+# Set the same value in Vercel environment variables.
+CRON_SECRET=change-me-to-a-random-urlsafe-string
 
 # ── Meta — Facebook Pages + Instagram Business ──────────
 FACEBOOK_APP_ID=
@@ -80,3 +83,7 @@ TWITTER_CLIENT_ID=
 TWITTER_CLIENT_SECRET=
 TWITTER_REDIRECT_URI=http://localhost:5000/auth/twitter/callback
 # Production: https://<your-domain>/auth/twitter/callback
+
+# ── Dev-only login bypass ────────────────────────────────
+# Must be ABSENT or empty in Vercel production.
+# DEV_LOGIN_KEY=