nutrition docker file fix

.env.example

@@ -146,18 +146,24 @@ NUTRITION_BASE=https://mcp.nearle.ai.in/api
 # five variables: its host, 587, the API key as MAIL_PASSWORD, and whatever
 # username it documents.
 #
-# WE RUN POSTAL — a self-hosted transactional mail server. Its SMTP endpoint is
-# the host below, and the credentials are a per-application pair generated in
-# Postal's UI, NOT a mailbox login. See docs/MAIL_SETUP.md for standing it up
-# and for the DNS records, which are what actually decide whether the invitation
-# reaches an inbox.
+# WE USE GOOGLE WORKSPACE SMTP, authenticating as care@nearledaily.com with a
+# 16-character App Password — never the account's login password, because an App
+# Password can be revoked on its own. See docs/MAIL_SETUP.md for the setup and
+# for the DNS records, which are what actually decide whether the invitation
+# reaches an inbox rather than a spam folder.
 #
-#   Postal (ours):      postal.nearledaily.com  587   credentials per-app
-#   Gmail / Workspace:  smtp.gmail.com          587   an app password, and only
-#                                                     ever for a smoke test
+# Self-hosting (Postal) was the earlier plan and is the better answer at volume.
+# At a few dozen invitations a month the work is not the software, it is IP
+# reputation, rDNS and blocklists — so this buys the reputation instead.
+#
+#   Google Workspace:   smtp.gmail.com          587   an App Password
+#     via an SMTP relay: smtp-relay.gmail.com   587   if an admin sets one up
 #   Amazon SES:         email-smtp.<region>.amazonaws.com  587
 #   SendGrid:           smtp.sendgrid.net       587   username literally "apikey"
 #   Resend:             smtp.resend.com         587   username literally "resend"
+#
+# Credentials belong in .env.secrets (git-ignored, read first), or in the
+# deployment platform's own environment — NOT in this file and not in .env.
 MAIL_HOST=
 MAIL_PORT=587
 # Optional. Leave both empty for a relay that authenticates by network rather