docs: align CD env vars with deployment guide and add gitea secrets reference

docs/DEPLOYMENT.md

@@ -131,22 +131,48 @@ No code changes needed in the pipeline. See `DEPLOYMENT.md` Production Deploymen
 
 ## Environment File
 
-Use .env with at least:
+Use `.env` with at least:
 
-- CI_REGISTRY_URL
-- CI_REGISTRY_NAMESPACE
-- CHAT_PORT
-- NGINX_PORT
-- DATABASE_URL (if overridden)
-- REDIS_URL (if overridden)
-- ADMIN_USERNAME
-- ADMIN_PASSWORD
-- VITE_PUBLIC_APP_URL
-- VITE_PUBLIC_WS_URL
-- VITE_PUBLIC_HLS_URL
-- Cloudflare/R2 variables when media sync is enabled
+- `DATABASE_URL` — PostgreSQL connection string
+- `REDIS_URL` — Redis connection string
+- `ADMIN_USERNAME` / `ADMIN_PASSWORD` — admin dashboard credentials
+- `ADMIN_SESSION_TTL_HOURS` — session expiry (default 12)
+- `VITE_PUBLIC_APP_URL` / `VITE_PUBLIC_WS_URL` / `VITE_PUBLIC_HLS_URL` — frontend URLs
 
-See .env.example and SETUP.md for full variable reference.
+**Cloudflare R2 (required for HLS segment sync to edge):**
+
+- `R2_ACCESS_KEY_ID` / `R2_SECRET_ACCESS_KEY` — R2 write credentials
+- `R2_BUCKET_NAME` — bucket name (e.g. `linearvoid-media`)
+- `R2_ENDPOINT` — S3-compatible endpoint URL
+- `R2_REGION` — set to `auto`
+
+**Cloudflare (optional, for Workers/Pages):**
+
+- `CLOUDFLARE_API_TOKEN` / `CLOUDFLARE_ACCOUNT_ID`
+- `MEDIA_DOMAIN` — split media domain (e.g. `media.linearvoid.tv`)
+
+See `.env.example` and `SETUP.md` for full variable reference.
+
+### Gitea Secrets
+
+The CD workflow (`cd.yml`) injects sensitive values from Gitea secrets into the `.env` file at deploy time. The following secrets must be configured in the Gitea repository:
+
+| Secret Name               | Description                          |
+| ------------------------- | ------------------------------------ |
+| `DATABASE_URL`            | PostgreSQL connection string         |
+| `ADMIN_USERNAME`          | Admin dashboard username             |
+| `ADMIN_PASSWORD`          | Admin dashboard password             |
+| `R2_ACCESS_KEY_ID`        | Cloudflare R2 access key             |
+| `R2_SECRET_ACCESS_KEY`    | Cloudflare R2 secret key             |
+| `R2_BUCKET_NAME`          | R2 bucket name                       |
+| `R2_ENDPOINT`             | R2 S3-compatible endpoint URL        |
+| `R2_ADMIN_ACCESS_KEY_ID`  | R2 admin access key (optional)       |
+| `R2_ADMIN_SECRET_ACCESS_KEY` | R2 admin secret key (optional)    |
+| `R2_ADMIN_ENDPOINT`       | R2 admin endpoint (optional)         |
+| `CLOUDFLARE_API_TOKEN`    | Cloudflare API token (optional)      |
+| `CLOUDFLARE_ACCOUNT_ID`   | Cloudflare account ID (optional)     |
+| `CI_REGISTRY_USER`        | Gitea container registry username    |
+| `CI_REGISTRY_TOKEN`       | Gitea container registry token       |
 
 ## Pull-and-Run Deployment