first commit

.gitignore

@@ -19,6 +19,7 @@
 
 # production
 /build
+/dist
 
 # misc
 .DS_Store
@@ -30,8 +31,23 @@ yarn-debug.log*
 yarn-error.log*
 .pnpm-debug.log*
 
-# env files (can opt-in for committing if needed)
-.env*
+# env files.
+#
+# `.env*` used to be blanket-ignored, and that was the deploy bug: the image
+# shipped with no LOYALY_API_BASE at all, so every BFF call died on "required
+# in production — refusing to guess the Loyaly platform host" and the console
+# looked like a broken login form. The production host is not a secret, so it
+# now lives in a committed `.env` and ships with the build.
+#
+# What stays ignored is the per-machine and per-secret layer:
+.env.local
+.env.*.local
+#
+# What is committed:
+#   .env          production defaults (no secret) — loaded by the running server
+#   .env.example  the template, the record of which variables exist
+#
+# AUTH_SECRET belongs in neither. It is injected by Dokploy at runtime.
 
 # vercel
 .vercel