Stabilize runtime auth and E2E coverage

.env.example

@@ -1,20 +1,37 @@
-# ── DB (NAS PostgreSQL 16 + pgvector, 단일 SoR) ──
-DATABASE_URL=postgresql://user:pass@nas:5432/vignette
+# Vignette local development env example.
+# Production/compose deployment should use infra/.env.example instead.
 
-# ── 엔진 게이트웨이 (람다 소유, app 은 HTTP 호출만) ──
-ENGINE_URL=http://engine:8100
-ENGINE_MODE=claude_api   # claude_api | claude_cli | openai | solar
+ENVIRONMENT=dev
+DATABASE_URL=postgresql://vignette_app:change-me-app@127.0.0.1:55432/vignette
 
-# ── 외부 LLM 키 (PII 마스킹 후만, 게이트웨이가 주로 사용) ──
+# Engine gateway. For local Claude CLI gateway, run apps/api/engine_gateway on 9099.
+ENGINE_URL=http://127.0.0.1:9099
+ENGINE_MODE=claude_cli
+
+# External providers. Keep real secrets in .env files only.
 ANTHROPIC_API_KEY=
 OPENAI_API_KEY=
+OPENAI_BASE_URL=https://api.openai.com/v1
 
-# ── 세션/인증 (BFF OAuth 2.1, 토큰 서버 보관) ──
+# Auth/session. Local dev may enable dev-login; public/prod must not.
 SESSION_SECRET=dev-insecure-change-me
 OAUTH_GOOGLE_CLIENT_ID=
 OAUTH_GOOGLE_CLIENT_SECRET=
-OAUTH_REDIRECT_URI=https://chanpaca.net/auth/callback
+OAUTH_REDIRECT_URI=https://api-vignette.chanpaca.net/auth/callback
+AUTH_ALLOWED_EMAIL_DOMAINS=["hs.ac.kr","twentyoz.kr"]
+AUTH_TEACHER_EMAILS=[]
+AUTH_ADMIN_EMAILS=[]
+AUTH_DEV_LOGIN_ENABLED=true
+DEFAULT_AFFILIATION=
+AUTO_SEED_PERSONAS=false
+ALLOW_SEED_PERSONA_FALLBACK=false
+EVALUATOR_GOLDEN_FEWSHOT_ENABLED=false
+FRONTEND_BASE_URL=http://localhost:5173
+CORS_ORIGINS=["http://localhost:5173","http://127.0.0.1:5173"]
 
-# ── 엔진 CLI 폴백 ──
+# Live2D runtime. Models must be configured per persona via live2dModelUrl.
+VITE_LIVE2D_CUBISM_CORE=/live2d/live2dcubismcore.min.js
+
+# Engine CLI fallback path.
 CLAUDE_P_PATH=claude
 GLM_OR_FALLBACK_MODEL=