Index: .env.example
===================================================================
--- .env.example	(revision bb42dfb3c61f3495f4ebd21e0066a369b7d0a202)
+++ .env.example	(revision 09ee2bd19e715e798f3d2b165d1d90f9c37eba7d)
@@ -1,12 +1,17 @@
 NODE_ENV=development
 PORT=3000
-SESSION_SECRET=change-me-to-a-strong-random-string-min-32-chars
+# Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
+# one on first start (saved to storage/.session-secret, stays stable across
+# restarts/updates). Or set your own: openssl rand -hex 32
+SESSION_SECRET=
 DATABASE_PATH=./storage/database.sqlite
 MEDIA_PATH=./storage/media
 
-# Canonical public URL of this site (scheme + host, no path/slash). Used for
-# links in emails (password reset) instead of request headers — prevents
-# host-header spoofing. Not set? Then it falls back to the request host (dev).
-PUBLIC_BASE_URL=https://example.com
+# Canonical public URL of this site (scheme + host, no trailing slash), e.g.
+# https://yourdomain.com . Used to build correct links in emails (password reset)
+# and OAuth redirects instead of trusting request headers (anti-spoofing).
+# Optional: leave empty and it falls back to the request host (fine for local/dev);
+# set it for production so email/login links point at the right place.
+PUBLIC_BASE_URL=
 
 # ── Administrator ───────────────────────────────────────────────────