fix(security): harden upstream critical surfaces (#32)

* fix(security): harden upstream critical surfaces

Refs #30

* fix(security): close pre-landing review gaps

Refs #30

* fix(security): close official release blockers

.env.example

@@ -5,6 +5,9 @@
 # LLM provider API keys: configure via the web dashboard setup wizard.
 
 # --- Gateway (required) ---
+# Required for Docker/external binds. Run ./prepare-env.sh to generate.
+# Local loopback-only development may opt into empty-token mode with:
+# GOCLAW_ALLOW_INSECURE_NO_AUTH=1
 GOCLAW_GATEWAY_TOKEN=
 GOCLAW_ENCRYPTION_KEY=
 POSTGRES_PASSWORD=