chore(ops): keep every operations credential name in .env.example and map where each lives

- .env.example lists the keys the scripts actually read (NAS_HOST/NAS_USER/
  NAS_SSH_PORT/NAS_DEPLOY_PATH, web build args, Supabase access token and
  project ref, CRON_SECRET, Cloudflare token/account/zone/tunnel) and drops
  unused ones (DSM_HOST, NAS_DEPLOY_ROOT, NAS_ADMIN_PORT, NAS_LANDING_PORT,
  APP_DOMAIN, ADMIN_DOMAIN).
- docs/map/02-infrastructure.md gains a credentials map (names only) with the
  matching Forgejo/Supabase/NAS copies, plus the public routing summary.
- Deploy scripts no longer point to the removed /admin static page or portal.

.env.example

@@ -1,13 +1,12 @@
 # Copy this file to .env for local operations only. Never commit populated values.
 
-# NAS deployment target
-DSM_HOST=
-DSM_SSH_PORT=22
+# NAS deployment target (scripts/deploy-nas.ps1, scripts/deploy-nas.sh)
+NAS_HOST=
+NAS_USER=
+NAS_SSH_PORT=22
+NAS_DEPLOY_PATH=/volume1/docker/d3ro
 DSM_SSH_USER=
 DSM_SSH_PASSWORD=
-NAS_DEPLOY_ROOT=/volume1/docker/d3ro-voice
-NAS_ADMIN_PORT=5000
-NAS_LANDING_PORT=4321
 
 # Git/Forgejo operations
 GIT_SERVER_URL=https://git.example.invalid
@@ -18,9 +17,8 @@ FORGEJO_TOKEN=
 FORGEJO_USERNAME=
 FORGEJO_PASSWORD=
 
-# Public service addresses
-APP_DOMAIN=voice.example.invalid
-ADMIN_DOMAIN=admin.voice.example.invalid
+# Public service addresses. The canonical values live in packages/core/src/web-urls.ts;
+# the NAS compose needs API_SERVER_URL for the admin login backend (https only).
 API_SERVER_URL=https://voice.example.invalid
 SITE_URL=https://voice.example.invalid
 CORS_ALLOWED_ORIGINS=https://voice.example.invalid,https://admin.voice.example.invalid
@@ -93,3 +91,21 @@ D3RO_WORKER_PUSH_DRAIN_BATCH_LIMIT=20
 # Optional authenticated mobile E2E account, stored only in CI secrets or local .env.
 MOBILE_E2E_EMAIL=
 MOBILE_E2E_PASSWORD=
+
+# Web app image build (apps/web/Dockerfile build args; public values baked into the bundle)
+NEXT_PUBLIC_SUPABASE_URL=
+NEXT_PUBLIC_SUPABASE_ANON_KEY=
+NEXT_PUBLIC_PAYPLE_CLIENT_KEY=
+
+# Supabase management (CLI / Management API without an interactive login)
+SUPABASE_PROJECT_REF=
+SUPABASE_ACCESS_TOKEN=
+
+# Payple renewal cron: same value as the Supabase function secret and the Forgejo secret
+CRON_SECRET=
+
+# Cloudflare (tunnel ingress, DNS, Pages and the site bridge worker)
+CLOUDFLARE_API_TOKEN=
+CLOUDFLARE_ACCOUNT_ID=
+CLOUDFLARE_ZONE_ID=
+CLOUDFLARE_TUNNEL_ID=