[Feat]: Per-LLM-call credit quota with admin UI (issue #15)

.env.example

@@ -194,4 +194,19 @@ OBSERVABILITY_RETENTION_DAYS=30
 #     rejects patches that would push the doc over this limit.
 #     Default 8192.
 MEMORY_THREAD_SUMMARY_KEEP_RECENT=10
-MEMORY_PROFILE_MAX_BYTES=8192
+MEMORY_PROFILE_MAX_BYTES=8192
+
+# Provider encryption KEK — AES-256-GCM key that wraps every entry in
+# `provider.apiKeys[].encryptedKey`. REQUIRED to start the server; the
+# admin UI returns 503 on first request if this is missing or malformed
+# (we refuse to silently fall back to "no encryption" mode).
+# Generate once with: openssl rand -hex 32
+# Set-and-forget: rotating it is out of scope for this project (would
+# require a one-shot re-encryption script over every row in provider.apiKeys).
+LLM_KEY_ENCRYPTION_KEY=
+
+# Bootstrap admin email. On signup, if the user's email matches this value
+# (case-insensitive), their role_id is set to 'admin'. Idempotent — leave
+# set forever; only the FIRST signup with this email is promoted. To add
+# a second admin later, use the admin UI role management tab.
+INITIAL_ADMIN_EMAIL=

.env.test

@@ -10,4 +10,9 @@ JINA_API_KEYS=jina_test_key_1,jina_test_key_2
 # to load; withAuth HOC tests mock getSession() directly so the secret
 # value is never validated against real signatures.
 BETTER_AUTH_SECRET=test_secret_aabbccddeeff00112233445566778899
-BETTER_AUTH_URL=http://localhost:3000
+BETTER_AUTH_URL=http://localhost:3000
+
+# LLM KEK — fake 32-byte key (64 hex chars) for unit tests. Used by
+# lib/provider/model-registry tests to round-trip a real encrypted key
+# through aesGcmDecrypt. Not a real KEK — never used in production.
+LLM_KEY_ENCRYPTION_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

CLAUDE.md

@@ -17,7 +17,6 @@ Guidance for Claude Code in this repo. Features, layout, env vars, tech stack 
 | Auth setup, OAuth, troubleshooting              | `docs/AUTH.md`          |
 | DB schema, ownership, indexes                   | `docs/DB.md`            |
 | CI/CD, Docker, deploys                          | `docs/CI.md`            |
-| Open follow-ups / parked decisions              | `docs/TODOS.md`         |
 
 API changes update `docs/APIS.md` in the same commit (rule 1). Tool changes update `docs/TOOLS.md` (rule 10).