ci: generate production .env dynamically in CD workflow and update secrets documentation

SETUP.md

@@ -12,7 +12,13 @@ This guide covers prerequisites, environment setup, running the application loca
 - **Git**: For cloning and version control.
 - **Cloudflare Account**: For R2 storage and CDN (free tier sufficient for most use cases).
 - **Gitea Account**: Required if you want to push images to the self-hosted registry or use the repository's CI/CD flow.
-  - Create new secrets in Gitea: Settings → Secrets → Actions, add `CI_REGISTRY_USER` (username) and `CI_REGISTRY_TOKEN` (token with `write:packages` scope)
+  - Set up the required Actions secrets in Gitea at: [https://git.allucanget.biz/zwitschi/linearvoid/settings/actions/secrets](https://git.allucanget.biz/zwitschi/linearvoid/settings/actions/secrets)
+  - Add the following secrets:
+    - `CI_REGISTRY_USER`: Your Gitea username (e.g., `zwitschi`)
+    - `CI_REGISTRY_TOKEN`: A Gitea Personal Access Token with `write:packages` scope
+    - `ADMIN_USERNAME`: The administrator username for the production admin panel (e.g., `admin`)
+    - `ADMIN_PASSWORD`: A strong password for the production admin panel
+    - `DATABASE_URL`: The production database connection string (e.g., `postgres://linearvoid:<password>@db:5432/linearvoid?sslmode=disable`)
 - **Hetzner Cloud Account** (optional for production): For the US-East VPS (Ashburn, VA recommended per ADR-001).
 
 ## Development Prerequisites
@@ -162,22 +168,31 @@ This guide covers prerequisites, environment setup, running the application loca
    - Generate a token with the scopes needed for package/registry access and, if applicable, repository automation.
    - Store it as `CI_REGISTRY_TOKEN` in `.env`.
 
-3. **Configure registry variables**:
+3. **Configure Gitea Actions Secrets**:
+   - Go to the repository settings page: [https://git.allucanget.biz/zwitschi/linearvoid/settings/actions/secrets](https://git.allucanget.biz/zwitschi/linearvoid/settings/actions/secrets)
+   - Add the following secrets to enable automated CI/CD and production deployment:
+     - `CI_REGISTRY_USER`: Your Gitea username (e.g., `zwitschi`).
+     - `CI_REGISTRY_TOKEN`: Your Gitea Personal Access Token with `write:packages` scope.
+     - `ADMIN_USERNAME`: The administrator username for the production admin panel (e.g., `admin`).
+     - `ADMIN_PASSWORD`: A strong password for the production admin panel.
+     - `DATABASE_URL`: The production database connection string (e.g., `postgres://linearvoid:<password>@db:5432/linearvoid?sslmode=disable`).
+
+4. **Configure registry variables**:
    - Set `CI_REGISTRY_URL` to the Gitea host.
    - Set `CI_REGISTRY_NAMESPACE` to the image namespace, for example `zwitschi/linearvoid`.
    - Set `CI_REGISTRY_USER` to the account that will push or pull images.
 
-4. **Authenticate Docker to the registry**:
+5. **Authenticate Docker to the registry**:
 
    ```bash
    docker login git.allucanget.biz
    ```
 
-5. **Build and publish images when needed**:
+6. **Build and publish images when needed**:
    - Local development uses `docker-compose.yml`, which builds from source.
    - Production uses `docker-compose.prod.yml`, which expects the `playout`, `chat`, and `nginx` images to exist in the configured Gitea registry namespace.
 
-6. **Validate image availability**:
+7. **Validate image availability**:
    - Before a production rollout, verify that the expected `:latest` tags can be pulled from the registry on the target server.
 
 ## Running the Application