Merge branch 'development'

Author: Siddharth-Khattar

.dockerignore

@@ -0,0 +1,38 @@
+# ABOUTME: Excludes files from the frontend Docker build context (context: . in CI).
+# ABOUTME: The backend Dockerfile uses context: ./backend, so this file does not affect it.
+
+# Backend (has its own Docker context at ./backend)
+backend/
+
+# Infrastructure and docs
+terraform/
+DEVELOPMENT_DOCS/
+DOCS/
+.planning/
+
+# VCS and IDE
+.git/
+.github/
+.claude/
+.kiro/
+.vscode/
+
+# Secrets (must never enter Docker context)
+.env
+.env.*
+!.env.example
+
+# Dependencies (reinstalled inside Docker)
+node_modules/
+frontend/node_modules/
+frontend/.next/
+
+# Misc
+.DS_Store
+LICENSE
+README.md
+GUIDE.md
+CLAUDE.md
+Makefile
+lefthook.yml
+docker-compose.yml

.env.example

@@ -10,6 +10,27 @@ CORS_ORIGINS=http://localhost:3000
 # Set to true for development, false for production
 DEBUG=true
 
+# Development API Key (local testing only)
+# Enables X-Dev-API-Key header authentication for Swagger UI testing
+# Generate a random key: python -c "import secrets; print(secrets.token_urlsafe(32))"
+# IMPORTANT: Never set this in production environments
+DEV_API_KEY=
+
 # Google Cloud Storage (optional)
 # Bucket name for evidence file storage
 GCS_BUCKET=
+
+# Service account email for signing GCS download URLs (local development only)
+# Required when running with user credentials (gcloud auth application-default login)
+# For Cloud Run with workload identity, this is auto-detected
+# Your user account needs roles/iam.serviceAccountTokenCreator on this SA
+GCS_SIGNING_SERVICE_ACCOUNT=
+
+# Gemini API Configuration (required for agent functionality)
+# Get your API key from: https://aistudio.google.com/apikey
+GOOGLE_API_KEY=
+
+GOOGLE_MAPS_API_KEY=
+
+# ADK backend toggle: set to TRUE to use Vertex AI instead of AI Studio
+GOOGLE_GENAI_USE_VERTEXAI=FALSE