excel file update

.env.production

@@ -55,7 +55,27 @@ AUTH_LOCKOUT_SECONDS=300
 # anyone who finds mcp.nearle.ai.in signs in as admin by typing anything at all.
 AUTH_ALLOW_ANY_LOGIN=false
 
-# Machine consumers. Empty: MCP clients authenticate with a login token instead.
+# Machine consumers. `name:role:secret` triples, comma-separated; keyed by the
+# secret, so deleting one entry revokes exactly one caller and leaves the rest
+# working. Role MUST be `admin` for the store-catalog / catalog-generate /
+# training routes: those guard with require_admin, which is a ROLE check, and
+# `admin` is a superuser - a key here unlocks every admin endpoint, not just
+# the one it was issued for.
+#
+# DELIBERATELY EMPTY HERE. The real value lives in the Dokploy Environment tab:
+#
+#   1. This file is committed. It already carries the DB password, S3 keys and
+#      the token-signing secret; a per-consumer API key is the one credential
+#      that gets issued and revoked often, and it does not belong in git.
+#   2. Dockerfile does `COPY .env.production .env`, so a value here is baked at
+#      BUILD time - issuing or revoking a key would mean rebuilding an image
+#      that installs CPU torch, which has already failed once on disk space.
+#      settings.py calls load_dotenv() WITHOUT override=True, so the tab's value
+#      wins and takes effect on a plain restart.
+#
+# Consequence: /api/health reports api_keys_source "process-env" for this one,
+# and that is correct here, not a warning. A value set below would be silently
+# ignored while the tab is populated - so leave it empty.
 API_KEYS=
 
 # --- Postgres / pgvector ---------------------------------------------------