move api secrets from configmap to .env-backed k8s Secret

.env.example

@@ -1,18 +1,21 @@
-# Copy to .env and fill in. Used by docker-compose; k8s pulls from the
-# nvi-config ConfigMap (ctrl/k8s/base/configmap.yaml).
+# Copy to `.env` (gitignored) and fill in. Two consumers:
+#
+# 1. k8s/kind path (tilt up): kustomize's secretGenerator in
+#    ctrl/k8s/base/kustomization.yaml reads this file and builds the
+#    nvi-secrets Secret. Non-secret config (DATABASE_URL, NVI_DATASET,
+#    *_MODEL, LANGFUSE_HOST, ...) lives in configmap.yaml — do not
+#    duplicate those here.
+# 2. docker-compose fallback (ctrl/docker-compose.yml): compose reads
+#    the same file via the shell.
 
-# Warehouse
-DATABASE_URL=postgresql://nvi:nvi@postgres:5432/nvi
-
-# Active dataset (selects api/datasets/<name>/ + Postgres schema + sqlite file).
-NVI_DATASET=financial
-
-# LLM
+# LLM API keys — set the one(s) matching your active LLM_PROVIDER.
+GROQ_API_KEY=
 ANTHROPIC_API_KEY=
-ANTHROPIC_MODEL=claude-sonnet-4-6
+# vLLM and other OpenAI-compatible self-hosted endpoints ignore auth;
+# the literal placeholder is fine.
+OPENAI_API_KEY=vllm-no-auth
 
-# Langfuse — set LANGFUSE_HOST to your lng WireGuard endpoint; create an
-# "nvi" project in the lng UI and paste its keys here.
-LANGFUSE_HOST=http://lng.local.ar:3000
+# Langfuse (nivii project on the lng cluster). Both keys are project-
+# scoped. Public key is safe by design; bundled for uniformity.
 LANGFUSE_PUBLIC_KEY=
 LANGFUSE_SECRET_KEY=