diff --git a/.env.bak-2026-07-28 b/.env.bak-2026-07-28
deleted file mode 100644
index 4d13e940..00000000
--- a/.env.bak-2026-07-28
+++ /dev/null
@@ -1,102 +0,0 @@
-# CrawlProof — local environment
-# This file is gitignored. Do not commit.
-
-# ---------- Site ----------
-NEXT_PUBLIC_SITE_URL=https://crawlproof.com
-
-# ---------- Supabase ----------
-# Project ref: ywcizjsgrcmhgyplldac
-# Get keys from: https://supabase.com/dashboard/project/ywcizjsgrcmhgyplldac/settings/api
-NEXT_PUBLIC_SUPABASE_URL=https://ywcizjsgrcmhgyplldac.supabase.co
-NEXT_PUBLIC_SUPABASE_ANON_KEY=sb_publishable_a8SgqPVlemtSVPE1sJb5CQ_oFXlIBPd
-SUPABASE_SERVICE_ROLE_KEY=sb_secret_o5miaAgk7KqxA-PW-s7dRw_rg5N2X1A
-
-# DB password — only needed for direct psql / `supabase db push`.
-SUPABASE_DB_PASSWORD=XXyZIOyha0KSe2zM
-
-# ---------- CoinPay (crypto credit purchases) ----------
-# Merchant + API key supplied by CoinPay dashboard.
-COINPAY_MERCHANT_ID=218c9732-50c0-4542-ad16-1a83f55538c4
-COINPAY_API_KEY=cp_live_36db63b9e87fed4a4baca7f673f4af1c
-# CoinPay HTTP API base; adjust if your CoinPay instance is hosted elsewhere.
-COINPAY_API_URL=https://coinpayportal.com
-# Used to verify webhook signatures (HMAC-SHA256 over raw body).
-COINPAY_WEBHOOK_SECRET=whsecret_43ef7164649e7b3bedf516a1268cce4b9655456740877ca9cad5dba91b727fd0
-
-# ---------- Resend (transactional email) ----------
-RESEND_API_KEY=re_Si92GTEM_33xCWHbnsQ3DhmQgum3XrJam
-RESEND_FROM=CrawlProof <reports@crawlproof.com>
-
-# ---------- Worker ----------
-# In the single-container Railway deploy the worker is on localhost.
-# WORKER_PORT must match the loopback port in WORKER_URL — start.sh used
-# to default to 8080 while WORKER_URL pointed at 9080, which silently
-# broke every worker-bound enqueue (autoblog delivery, audit kick-off).
-WORKER_URL=http://127.0.0.1:9080
-WORKER_PORT=9080
-WORKER_SHARED_SECRET=MqHuZTa9xBhvScyykIjdZZRVGonzA4nhh2V8Ly8nrj0
-
-# ---------- Cron ----------
-CRON_SECRET=jIlEofmw0FBKuUVQewjLugcFn9vcted7tWzeT9G7jFg
-
-# ---------- Anthropic — paid scans run Claude Opus 4.7 ----------
-ANTHROPIC_API_KEY=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
-
-# ---------- Next.js server action closure encryption ----------
-# Stable key so encrypted action closures from one deploy can still be
-# decrypted on the next. Used at build AND runtime — keep it the same.
-NEXT_SERVER_ACTIONS_ENCRYPTION_KEY=IWa/cBI4x6urAes/ZzNTXO38m6VAPRkO+KfRm7jNAv4=
-
-# ---------- Paid engines ----------
-BACKEND_AI_PROVIDER=openai
-BACKEND_AI_OPENAI_MODEL=gpt-5.5
-OPENAI_API_KEY=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
-GEMINI_API_KEY=AIzaSyC5pQVScjttZONatDsAccZTVqcaAFhv9WA
-# Qwen via Alibaba Cloud Model Studio (DashScope).
-DASHSCOPE_API_KEY=sk-2ea2783374594749ac12b561c193d3c7
-# Kimi via Moonshot AI.
-MOONSHOT_API_KEY=sk-1An97Cdeqoluw7avoOa799Q8sIbED6AosRemT7lVUx3GTYgv
-# DeepSeek.
-DEEPSEEK_API_KEY=sk-d40dbce41e2646afb7ee855656f5b06a
-# Z.AI (Zhipu) GLM — OpenAI-compatible. Key format: <id>.<secret>.
-ZAI_API_KEY=e37359a7992b4fa3af4246175b8d2f5f.ml6rLO8RsjVBtHDK
-# Perplexity — Sonar API, OpenAI-compatible.
-PERPLEXITY_API_KEY=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
-# HuggingFace.
-HUGGINGFACE_API_KEY=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
-# DataForSEO — keyword research for Autoblog. Basic auth.
-DATAFORSEO_LOGIN=anthony@profullstack.com
-DATAFORSEO_PASSWORD=116960f7c7a9c393
-
-# ---------- Observability ----------
-SENTRY_DSN=
-SOCIAL_VAULT_KEY=SwbGDG/K/n0IhVnhieE6Ga95sJidRF2GHis93I12Rz0=
-
-# ---------- Social posting — Meta (Facebook / Instagram) ----------
-META_APP_ID=994377213462196
-META_APP_SECRET=411f562235f73f1201e4b51a19592aaa
-
-# ---------- Social posting — Threads ----------
-THREADS_APP_ID=1647193763244473
-THREADS_APP_SECRET=0604eb698c2cf1caf95af644a7dfa37f
-# Kimi (kimi.com endpoint — alt to MOONSHOT_API_KEY which targets api.moonshot.ai)
-KIMI_API_KEY=sk-kimi-zExTu48ugqwJs6JKciFDZUyRsxDhyBCJi3yLQ0IhimtKIwfJltsaRzvaXtxykmdK
-
-# GitHub App — registered on the profullstack org via the App Manifest flow.
-# Don't commit. Re-run /admin/github/setup if these need to be rotated.
-GITHUB_APP_ID=3811357
-GITHUB_APP_SLUG=crawlproof
-GITHUB_APP_CLIENT_ID=Iv23liLyqvYTbh1PMMn8
-GITHUB_APP_CLIENT_SECRET=1644e6db895845636c9a1bb8451ac83ebed4ef52
-GITHUB_APP_WEBHOOK_SECRET=fc97dd7ec199c47d909da7c8d9cf80b7b9643a30
-GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAmaZTM8mshRtWYkvWhmZnLbkf4Z1fafwAwqXj0gBlWSeBv3o5\nBSTM3HLy0bWWAMVO1xdDQoOsmuX3ZCSozY+BgoWOYucCUcSnt7B6zKDKglPZ27jW\neBLshtqhy9l7w5qg2l0OPXdASDHrkBY8e7wXsEZz8tdgqfGB/58iHQJ3nAMw/BgO\nRIwNM+YyGDk8psWYOy44J1oDTslM+ysECXTKlap76GyEiT8vMARsZJsSf3fA1DPc\nkd1SP4zKMdNysC+60YxWrNPGTGoOrSZs6PaZb5Qch/GuN4JKKPzexOoZktFl6tRi\nnLAHKJkL4DKITZTmsXTB7eNwAjrDp5TkOj/M7QIDAQABAoIBAHHCxvmiCTzoN7ZB\npk0ORriAx40ZIsrqzXlQr/QNXPx8lsE5cjxPuepCpWwFgVGCxNPWInN94G8zc07P\nIbhI1z/XOMwbdAksjG0hmloldqq2AKiBGzH9+OgDuiWfGdaChzQGEAQMZijN5TZi\ncFfAtN1L3I9hTe2lpXWo0e4epIZ6ZKnf9eeSsoEGUnhKQr83plH1dI02fmJX+Gtd\nPvspUbyV09jZ3iLR2V9bY7azdxU+6wXoSk5GkfCojdZJlxoqy+8eanMlDT/i0kzx\nEKmLRAeVdp5PfCYQhYSw7O1825+NZV+rw1RnMlVAswecGPd+dR78uYVD0OXaNKtl\n3/zxdpUCgYEAyrBHQjLYN8oaHfl6h/albIeERzaVNP7j+xzciACuKnBDXskxzAO6\n/W/ARpd31noHsZfUNUM7uKiYNdwwZ7ynTmkC1G3q8TlzZ5nUrOXFTuR0YHUKz/yQ\nlOChUSs7ZQGwcA6XFbVqlp94/HAFSLxbfhtUeXv3XK7lcDlVGWQlU1cCgYEAwhAW\n95OFqLUK0P4D1yBPKOxq1YS1Zw3VwzfdqfgMw2OnopY6RxZRQUg0eQWmzgFoL8B2\nok7VF1KOgp/UMiAxiPTXWdXGZ8Ob7EJIc2jCHum4/IeysVsz08f9FfaHKDCztAcl\nr4ovyfV6/kuamQgxQQ1ZvVTca9MI4Eg2dRK3G1sCgYEAjJbtNnuyAjCLIRN07G4m\nnDr7g7HWmOXcGMgSJ7vhEsq/0DVZ9xr3Tud+xPg3RWtrfsHDjhZOjG1U9rb+VFZE\n7lxkfBiqCBxDci7/l9XgoDJSjr1gfJfBaaLOAlEsZ4learuUDJjDkCqZbu/8mlEc\nXUJzu7hDAeTGfKsn3e7a/Q0CgYBKgTTgHjIdgExDypIc4Jmjo4isqwOeKhCcn3Ep\n1ULJLRRp9nUvX6EYiCklIYdV5fJjCuhBDjT/fEGcYtJr4DJEW4PmSI2gvte5EAWS\n0XBdv+u2gD6ZmuM99rTy3rArPO9xOaE9ULdiOS3cPZiAEkYerIp8hv0NJHtu6CqI\nLgRAqwKBgQDFhX5Q0IMGNQbJWT5xwWXfGYvXssZE2LsjUSIjiqDVXU3FkgX6OFWO\nibyh5GwNmZn+LBwHOJ3Cf5WRjllyfJwb78yEU6da33+cyHR5+8KeJ6xVpOMjWU9e\na3tvwJOb8bE5PNwQ5Dg3QoyRUid+LjtId6rO+it3fKx/xhjE0xLUoQ==\n-----END RSA PRIVATE KEY-----\n"
-
-# Peppers sha256 hashes of API tokens (sp_api_token + project_api_keys)
-SP_TOKEN_PEPPER=RqYRUvLiBrqilHqIOOVJHtWl2T2ffK0LLd+VImjzGwY=
-
-# Audience Hub ingest key for this project ("prod" key, revealable in dashboard)
-CRAWLPROOF_PROJECT_KEY=cpk_EhiJth_9UcD_T-X1KqzVkLJEtFc0K_wV-lZ-owHZCZ8
-
-# CrawlProof Alerts — ValueSERP (Google SERP polling)
-VALUESERP_API_KEY=5F0086E0C4D74B4A9113A89A945BA376
-ALERTS_FROM=CrawlProof Alerts <alerts@crawlproof.com>
diff --git a/.gitignore b/.gitignore
index b99c4283..a27b37ab 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,11 +1,9 @@
 node_modules
 .next
-.env
-.env.local
-.env.*.local
-.env.development
-.env.production
-.env.test
+# Ignore every env file, then allow the checked-in template back. Deliberately
+# broad: the old list named each variant explicitly, so `.env.bak-2026-07-28`
+# matched none of them and a full production environment landed in git.
+.env*
 !.env.example
 *.log
 *.mmdb