cleanup: remove DEBUG_EMAIL_PASSWORD email/password backdoor; add MIT LICENSE + .env.example

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,32 @@
+# intervalsicu-mcp-auth — environment (copy to .env; do not commit real secrets)
+
+# Public base URL of this auth server. The OAuth/OIDC issuer is <this>/api/auth.
+BETTER_AUTH_URL=https://intervalsicu.farhoodlabs.com
+# Better Auth signing secret — generate a long random string.
+BETTER_AUTH_SECRET=
+# Postgres connection string (the shared CNPG database).
+AUTH_DATABASE_URL=postgres://user:password@host:5432/dbname
+
+# Google social login credentials.
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# Optional Apple sign-in (added only if all three are set).
+# APPLE_CLIENT_ID=
+# APPLE_CLIENT_SECRET=
+# APPLE_APP_BUNDLE_IDENTIFIER=
+
+# Comma-separated allowed token audiences / RFC 8707 resources — must include the
+# MCP server's /mcp URL so issued access tokens carry the right aud.
+VALID_AUDIENCES=https://intervalsicu.farhoodlabs.com/mcp
+# Comma-separated trusted origins for Better Auth.
+TRUSTED_ORIGINS=https://intervalsicu.farhoodlabs.com
+
+# Logger level: debug | info (default info).
+LOG_LEVEL=info
+# HTTP listen port (default 8080).
+PORT=8080
+
+# Portal OIDC client seeded by migrate.ts (both have defaults; override if needed).
+# PORTAL_CLIENT_ID=
+# PORTAL_REDIRECT_URI=