remove user-secrets approach & prepare a pilot deploy

telegram-otp-bot/.env.example

@@ -1,4 +1,6 @@
-# Copy to .env and fill in. Never commit .env.
+# Copy to .env and fill in — for LOCAL runs (`npm start`) only. Never commit .env.
+# The deployed stack sets every one of these in the root docker-compose.yml instead; nothing here is read
+# inside the container.
 
 # From @BotFather — the full token, e.g. 1234567890:AAH....
 TELEGRAM_BOT_TOKEN=8968527151:AAFiCuNGkXjOiLZfT6urU8tkW8SCsWDM0ic
@@ -12,7 +14,10 @@ TELEGRAM_CHAT_IDS=1277103616,110209855
 # REQUIRED. Shared secret the caller must send as the `X-Api-Key` header.
 # Minimum 16 chars; the process refuses to start without it.
 # Generate one:  node -e "console.log(require('crypto').randomBytes(24).toString('hex'))"
-# The same value goes into the .NET side's Seams:Sms:Telegram:ApiKey (user-secrets, never committed).
+# The same value goes into the .NET side's Seams:Sms:Telegram:ApiKey (appsettings.Development.json).
+#
+# The value below is the PUBLISHED EXAMPLE — it is in git and in the README, so it is not a secret, and
+# TelegramSmsSender deliberately refuses to authenticate with it. Replace it in your own .env.
 API_KEY=ab8984974bc1fe5ce514d0fd74f71c8738b3aed92a7e4d86
 
 # HTTP listener
@@ -27,6 +32,7 @@ REDACT_CODE_IN_LOGS=false
 # this process tunnels its Telegram calls through it (HTTP CONNECT or SOCKS5, with optional
 # user:pass@ credentials). Leave it unset for a direct connection — nothing else changes.
 #   local machine with a VPN client:   http://127.0.0.1:10809  /  socks5://127.0.0.1:10808
-#   VPS with a proxy container:        http://proxy:1080  (the container name on the shared docker network)
+#   VPS with a proxy container:        http://hysteria-client:8081  (the container name on caddy_net —
+#                                      what the deployed stack uses, set in the root docker-compose.yml)
 # HTTPS_PROXY / ALL_PROXY are honoured as a fallback if TELEGRAM_PROXY_URL is unset.
 # TELEGRAM_PROXY_URL=http://127.0.0.1:10809