chore(ops): keep every operations credential name in .env.example and map where each lives

- .env.example lists the keys the scripts actually read (NAS_HOST/NAS_USER/
  NAS_SSH_PORT/NAS_DEPLOY_PATH, web build args, Supabase access token and
  project ref, CRON_SECRET, Cloudflare token/account/zone/tunnel) and drops
  unused ones (DSM_HOST, NAS_DEPLOY_ROOT, NAS_ADMIN_PORT, NAS_LANDING_PORT,
  APP_DOMAIN, ADMIN_DOMAIN).
- docs/map/02-infrastructure.md gains a credentials map (names only) with the
  matching Forgejo/Supabase/NAS copies, plus the public routing summary.
- Deploy scripts no longer point to the removed /admin static page or portal.

docs/map/02-infrastructure.md

@@ -226,3 +226,20 @@ See [`11-gap-backlog.md`](./11-gap-backlog.md) for the maintained list (`INFRA-*
 - `apps/mobile-rn` is not an npm workspace member; use `typecheck:mobile`/`lint:mobile`/`test:mobile` or `verify:all`.
 - Admin NAS deploy job disabled in GitLab CI; the `package-admin-docker`→GHCR publish step lived only in the now-deleted `.github/workflows/release.yml` (2026-09-26, dc43884) and was not ported to Forgejo, so admin image publish + NAS compose update is manual (`GAP-INFRA-02`).
 - Two identity systems (.NET JWT/SQLite vs Supabase); a canonical resolver now exists in `@d3ro/core/entitlement` but web/mobile/.NET adoption is incremental (`11` GAP-ID-02).
+
+## 운영 자격 증명 위치 (2026-09-26, 값은 적지 않는다)
+
+재로그인 없이 배포·운영하려고 모은 목록이다. 로컬 값은 루트 `.env`(gitignore), 이름 목록은 `.env.example`이 정본이다.
+
+| 용도 | 루트 `.env` 키 | 다른 곳의 같은 값 |
+|---|---|---|
+| Cloudflare 터널 ingress·DNS·Pages·브리지 워커 | `CLOUDFLARE_API_TOKEN`(토큰 이름 "D3RO Voice — tunnel + DNS"), `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_ZONE_ID`, `CLOUDFLARE_TUNNEL_ID`(kd-nas) | Forgejo 시크릿 `CF_API_TOKEN`·`CF_ACCOUNT_ID` |
+| Supabase CLI·Management API | `SUPABASE_ACCESS_TOKEN`(만료 2027-09-25), `SUPABASE_PROJECT_REF` | — |
+| Payple 정기 갱신 cron | `CRON_SECRET` | Supabase 함수 시크릿 `CRON_SECRET`, Forgejo 시크릿 `CRON_SECRET` |
+| NAS 배포(ssh 별칭 `yunchan-nas`) | `NAS_HOST`, `NAS_USER`, `NAS_SSH_PORT`, `NAS_DEPLOY_PATH` | — |
+| NAS compose 필수 값 | `SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, `ADMIN_BOOTSTRAP_TOKEN`, `API_SERVER_URL` 외 | NAS `/volume1/docker/d3ro/.env` |
+| 웹앱 이미지 build arg | `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY` (`NEXT_PUBLIC_PAYPLE_CLIENT_KEY`는 보류, GAP-BILL-02) | — |
+| Forgejo API | `FORGEJO_TOKEN` | Forgejo 시크릿 `FORGEJO_TOKEN` |
+
+- 공개 라우팅: `d3ro.chanpaca.net` → 브리지 워커 → `/app`·`/api`·`/health`는 터널 kd-nas(NAS 3002·5050), 그 밖은 Pages `d3ro`. 터널 ingress `d3ro.chanpaca.net` path `^/app` → `http://192.168.0.39:3002`.
+- Supabase Auth: `site_url=https://d3ro.chanpaca.net/app`, 허용 목록에 `/app/**`.