feat: prepare six-lesson trial backend with reliable rewards and operations

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -1,14 +1,19 @@
-# Server — production cutover uses PORT=3000 (replaces legacy Fastify)
+# Server — production trial uses PORT=3000
 PORT=3000
 HOST=0.0.0.0
 NODE_ENV=development
 
-# CORS (Vue dev server)
-CORS_ORIGIN=http://localhost:5173
+# CORS — exact browser origin(s); comma-separated for multiple trial hosts
+CORS_ORIGIN=http://localhost:5174
 
-# SQLite — path inside container or on host (DB_PATH or DATABASE_PATH)
+# SQLite — persistent path (container: /app/data/app.db)
 # DB_PATH=/app/data/app.db
 # DATABASE_PATH=/app/data/app.db
 
-# JWT — must match legacy Fastify when migrating existing tokens
+# JWT — required in production (min 32 chars, not a placeholder below)
 JWT_SECRET=gold-land-dev-secret-change-in-production
+
+# Only when behind a known reverse proxy (optional in development)
+# TRUST_PROXY=false
+# Required in production when TRUST_PROXY=true — set your proxy/Docker network CIDR(s), not empty:
+# TRUST_PROXY_CIDRS=172.20.0.0/16