# =============================================================================
# OpenMAIC Environment Variables
# Copy this file to .env.local and fill in the values you need.
# All variables are optional — only configure the providers you want to use.
# You can also use server-providers.yml for configuration (see docs).
# =============================================================================

# --- LLM Providers -----------------------------------------------------------
# Format: {PROVIDER}_API_KEY, {PROVIDER}_BASE_URL (optional), {PROVIDER}_MODELS (optional, comma-separated)

OPENAI_API_KEY=
OPENAI_BASE_URL=
OPENAI_MODELS=
# For relays whose non-streaming Chat Completions response is incompatible.
# Forces custom OpenAI base URLs to use Chat Completions and buffers SSE responses.
# Has no effect on the official OpenAI base URL. Disabled by default.
# OPENAI_COMPAT_USE_STREAMING_CHAT=true

# Azure uses deployment names as model IDs.
AZURE_OPENAI_API_KEY=
AZURE_OPENAI_BASE_URL=https://YOUR-RESOURCE.openai.azure.com/openai
AZURE_OPENAI_MODELS=

ATLASCLOUD_API_KEY=
ATLASCLOUD_BASE_URL=https://api.atlascloud.ai/v1
# Example: qwen/qwen3.5-flash,deepseek-ai/deepseek-v4-pro
ATLASCLOUD_MODELS=

ANTHROPIC_API_KEY=
ANTHROPIC_BASE_URL=
ANTHROPIC_MODELS=

GOOGLE_API_KEY=
GOOGLE_BASE_URL=
GOOGLE_MODELS=

DEEPSEEK_API_KEY=
DEEPSEEK_BASE_URL=
# Example: deepseek-v4-pro,deepseek-v4-flash
DEEPSEEK_MODELS=

QWEN_API_KEY=
QWEN_BASE_URL=
QWEN_MODELS=

KIMI_API_KEY=
KIMI_BASE_URL=
KIMI_MODELS=

MINIMAX_API_KEY=
# MiniMax Anthropic-compatible endpoint for the built-in Anthropic SDK integration
MINIMAX_BASE_URL=https://api.minimaxi.com/anthropic/v1
# Example: MiniMax-M2.7-highspeed,MiniMax-M2.7,MiniMax-M2.5-highspeed,MiniMax-M2.5
MINIMAX_MODELS=

GLM_API_KEY=
GLM_BASE_URL=
GLM_MODELS=

SILICONFLOW_API_KEY=
SILICONFLOW_BASE_URL=
SILICONFLOW_MODELS=

DOUBAO_API_KEY=
DOUBAO_BASE_URL=
DOUBAO_MODELS=

OPENROUTER_API_KEY=
OPENROUTER_BASE_URL=https://openrouter.ai/api/v1
# Example: deepseek/deepseek-v4-pro,deepseek/deepseek-v4-flash
OPENROUTER_MODELS=

GROK_API_KEY=
GROK_BASE_URL=
# Example: grok-4.6,grok-4.5
GROK_MODELS=

TENCENT_API_KEY=
# Tencent TokenHub OpenAI-compatible endpoint. Hy3 is a model ID, not an env prefix.
# TENCENT_HUNYUAN_* is also accepted as an alias.
TENCENT_BASE_URL=https://tokenhub.tencentmaas.com/v1
# Example: hy3-preview,hunyuan-2.0-thinking-20251109,hunyuan-2.0-instruct-20251111
TENCENT_MODELS=

XIAOMI_API_KEY=
# MIMO_* is also accepted as an alias. Use tp-... keys only with Token Plan URLs.
XIAOMI_BASE_URL=https://api.xiaomimimo.com/v1
# Token Plan regional examples:
# XIAOMI_BASE_URL=https://token-plan-cn.xiaomimimo.com/v1
# XIAOMI_BASE_URL=https://token-plan-sgp.xiaomimimo.com/v1
# XIAOMI_BASE_URL=https://token-plan-ams.xiaomimimo.com/v1
# Example: mimo-v2.5-pro,mimo-v2-pro,mimo-v2.5,mimo-v2-omni,mimo-v2-flash
XIAOMI_MODELS=

# --- Ollama (Local Models) ---------------------------------------------------
# No API key needed. Configure BASE_URL here (server-side) so it bypasses SSRF
# protection automatically. Client-supplied localhost URLs are blocked in production.
# OLLAMA_BASE_URL=http://localhost:11434/v1
# OLLAMA_MODELS=llama3.3,llama3.2,qwen2.5,mistral,gemma3

# Lemonade local server (OpenAI-compatible, no API key required)
# LEMONADE_BASE_URL=http://localhost:13305/v1
# LEMONADE_MODELS=Qwen3-0.6B-GGUF,Llama-3.2-1B-Instruct-Hybrid,Qwen2.5-VL-7B-Instruct

# Amazon Bedrock LLMs (no OpenAI-style API key required)
# Set BEDROCK_REGION to enable Bedrock server-side provider config.
# AWS credentials are resolved from the standard AWS environment / credential chain.
# BEDROCK_REGION=us-east-1
# BEDROCK_MODELS=us.anthropic.claude-sonnet-5,us.anthropic.claude-opus-4-8
# Optional bearer-token authentication or custom Bedrock-compatible endpoint.
# AWS_BEARER_TOKEN_BEDROCK=
# BEDROCK_API_KEY=
# BEDROCK_BASE_URL=
# DEFAULT_MODEL=bedrock:us.anthropic.claude-sonnet-5

# --- TTS (Text-to-Speech) ----------------------------------------------------

TTS_OPENAI_API_KEY=
TTS_OPENAI_BASE_URL=

TTS_AZURE_API_KEY=
TTS_AZURE_BASE_URL=

TTS_GLM_API_KEY=
TTS_GLM_BASE_URL=

TTS_QWEN_API_KEY=
TTS_QWEN_BASE_URL=

TTS_DOUBAO_API_KEY=
TTS_DOUBAO_BASE_URL=

TTS_MINIMAX_API_KEY=
# MiniMax TTS endpoint (speech-2.8 / 2.6 / 02 / 01 series)
TTS_MINIMAX_BASE_URL=https://api.minimaxi.com
TTS_ELEVENLABS_API_KEY=
TTS_ELEVENLABS_BASE_URL=

# VoxCPM2 TTS (local, OpenAI-compatible; API key is optional)
# TTS_VOXCPM_API_KEY=
# TTS_VOXCPM_BASE_URL=http://localhost:8000/v1

# Lemonade TTS (local, no API key required)
# TTS_LEMONADE_BASE_URL=http://localhost:13305/v1

# Operators can force-disable any built-in TTS provider. Examples:
# TTS_OPENAI_ENABLED=false
# TTS_BROWSER_NATIVE_ENABLED=false

# --- ASR (Automatic Speech Recognition) --------------------------------------

ASR_OPENAI_API_KEY=
ASR_OPENAI_BASE_URL=

ASR_QWEN_API_KEY=
ASR_QWEN_BASE_URL=

ASR_AZURE_API_KEY=
ASR_AZURE_BASE_URL=https://{region}.api.cognitive.microsoft.com

# FunASR (local, WAV input only, no API key required)
# ASR_FUNASR_BASE_URL=http://localhost:8000/v1

# Lemonade ASR (local, WAV input only, no API key required)
# ASR_LEMONADE_BASE_URL=http://localhost:13305/v1


# --- PDF Processing -----------------------------------------------------------

PDF_UNPDF_API_KEY=
PDF_UNPDF_BASE_URL=

PDF_MINERU_API_KEY=
PDF_MINERU_BASE_URL=
# Optional. Defaults to "pipeline"; use "hybrid-auto-engine" only when your MinerU
# service has the required GPU/device configuration.
PDF_MINERU_BACKEND=

PDF_MINERU_CLOUD_API_KEY=
PDF_MINERU_CLOUD_BASE_URL=https://mineru.net/api/v4

# AliDocMind uses an Alibaba Cloud AccessKey pair instead of a single API key.
ALIDOCMIND_ACCESS_KEY_ID=
ALIDOCMIND_ACCESS_KEY_SECRET=
ALIDOCMIND_BASE_URL=

# --- Image Generation ---------------------------------------------------------

IMAGE_OPENAI_API_KEY=
IMAGE_OPENAI_BASE_URL=https://api.openai.com/v1

IMAGE_SEEDREAM_API_KEY=
IMAGE_SEEDREAM_BASE_URL=

IMAGE_QWEN_IMAGE_API_KEY=
IMAGE_QWEN_IMAGE_BASE_URL=

IMAGE_NANO_BANANA_API_KEY=
IMAGE_NANO_BANANA_BASE_URL=

IMAGE_MINIMAX_API_KEY=
# Example models: image-01, image-01-live
IMAGE_MINIMAX_BASE_URL=https://api.minimaxi.com

IMAGE_GROK_API_KEY=
IMAGE_GROK_BASE_URL=

# Lemonade image generation (local, no API key required)
# IMAGE_LEMONADE_BASE_URL=http://localhost:13305/v1

# --- Video Generation ---------------------------------------------------------

VIDEO_SEEDANCE_API_KEY=
VIDEO_SEEDANCE_BASE_URL=

VIDEO_KLING_API_KEY=
VIDEO_KLING_BASE_URL=

VIDEO_VEO_API_KEY=
VIDEO_VEO_BASE_URL=

VIDEO_SORA_API_KEY=
VIDEO_SORA_BASE_URL=

VIDEO_MINIMAX_API_KEY=
# Example models: MiniMax-Hailuo-2.3, MiniMax-Hailuo-2.3-Fast, MiniMax-Hailuo-02
VIDEO_MINIMAX_BASE_URL=https://api.minimaxi.com

VIDEO_GROK_API_KEY=
VIDEO_GROK_BASE_URL=

VIDEO_HAPPYHORSE_API_KEY=
VIDEO_HAPPYHORSE_BASE_URL=https://dashscope.aliyuncs.com

# --- Web Search ---------------------------------------------------------------
# Note: Grok (xAI) web search is available via chat completions + search tools,
# not as a standalone search API. Use Grok LLM provider with search_parameters
# in chat requests. See: https://docs.x.ai/docs/guides/tools/search-tools

TAVILY_API_KEY=
TAVILY_BASE_URL=
BOCHA_API_KEY=
BOCHA_BASE_URL=https://api.bocha.cn
BRAVE_API_KEY=
BRAVE_BASE_URL=
BAIDU_API_KEY=
BAIDU_BASE_URL=https://qianfan.baidubce.com
# Self-hosted SearXNG instance (no API key required)
SEARXNG_BASE_URL=
# Dedicated MiniMax web-search vars avoid conflicting with the LLM MINIMAX_* endpoint.
WEB_SEARCH_MINIMAX_API_KEY=
WEB_SEARCH_MINIMAX_BASE_URL=https://api.minimaxi.com
# Claude (Anthropic) native web search. Dedicated vars avoid conflicting with
# ANTHROPIC_* LLM provider vars. Optional WEB_SEARCH_CLAUDE_MODELS pins the
# search model server-side (first entry wins), e.g. claude-sonnet-5.
WEB_SEARCH_CLAUDE_API_KEY=
WEB_SEARCH_CLAUDE_BASE_URL=https://api.anthropic.com/v1
WEB_SEARCH_CLAUDE_MODELS=

# Optional Pi Director web search through any OpenAI-compatible Responses API.
# A gateway such as ModelVerse is represented only by its URL, not as a
# provider identity. Example model: gpt-5.4-nano.
# OPENMAIC_ENABLE_PI_WEB_SEARCH=true
# RESPONSES_WEB_SEARCH_API_KEY=
# RESPONSES_WEB_SEARCH_BASE_URL=https://api.example.com/v1
# RESPONSES_WEB_SEARCH_MODEL=gpt-5.4-nano

# --- Experimental Features ---------------------------------------------------

# Boolean feature flags accept "true" or "1". NEXT_PUBLIC_* values are compiled
# into the browser bundle at build time, so changing them requires a rebuild.

# Master gate for the MAIC Editor Pro-mode entry point.
# NEXT_PUBLIC_MAIC_EDITOR_ENABLED=true

# Select @openmaic/editor inside Pro mode. This does not enable Pro mode by itself.
# NEXT_PUBLIC_MAIC_EDITOR_RENDERER_ENABLED=true

# Use @openmaic/renderer for the classroom playback canvas.
# NEXT_PUBLIC_MAIC_PLAYBACK_RENDERER_ENABLED=true

# Use the experimental Pi-based classroom chat runtime. Disabled by default.
# NEXT_PUBLIC_PI_CHAT_ENABLED=true

# Enable the server-side vocational task-engine generation path.
# OPENMAIC_ENABLE_VOCATIONAL=true

# Show the experimental vocational task-engine control in the client.
# NEXT_PUBLIC_SHOW_VOCATIONAL_TEST_UI=true

# Show the video export and PPTX import entry points.
# NEXT_PUBLIC_ENABLE_VIDEO_EXPORT=true
# NEXT_PUBLIC_ENABLE_PPTX_IMPORT=true

# Informational destination shown on exported Quiz/PBL cover cards. Unset or
# blank defaults to open.maic.chat; set to "off" to omit it.
# NEXT_PUBLIC_VIDEO_EXPORT_CTA_DESTINATION=open.maic.chat

# --- Proxy (optional) --------------------------------------------------------

# HTTP_PROXY=
# HTTPS_PROXY=
# Comma-separated hosts that bypass the proxy. Supports domain suffixes and *.
# NO_PROXY=localhost,127.0.0.1,.internal.example.com

# --- Misc ---------------------------------------------------------------------

# Server-side default model for API routes like /api/generate-classroom.
# Required for server-side stages (those that don't receive a client x-model):
# resolveModel throws if a stage resolves to no model (no MODEL_ROUTES entry, no
# x-model, no DEFAULT_MODEL) — there is intentionally no hardcoded vendor fallback.
# Example: anthropic:claude-3-5-haiku-20241022 or google:gemini-3-flash-preview
# OpenAI example: openai:gpt-5.5
# MiniMax example: minimax:MiniMax-M2.7-highspeed
# Bedrock example: bedrock:us.anthropic.claude-sonnet-5
DEFAULT_MODEL=

# Optional per-stage model routing (#745). A JSON object mapping a generation
# stage to a model string (`provider:model`). Resolution order for a stage:
# stage route > x-model (client) > DEFAULT_MODEL. A configured route is the
# operator's deliberate choice and wins even when the browser sends its saved
# model as x-model. Unset = identical to today (everything uses DEFAULT_MODEL).
# Unlisted stages fall back to x-model then DEFAULT_MODEL, so you can override
# just one or two and leave the rest to the client/default.
# Point a stage only at a server-configured provider (its key resolvable); a
# route to an unconfigured/invalid model fails at request time for that stage,
# the same way a bad DEFAULT_MODEL would (no startup validation).
# Routable stages: scene-outlines-stream, scene-content, scene-actions,
# agent-profiles, quiz-grade, pbl-chat, chat-adapter, generate-classroom,
# web-search-query-rewrite.
# scene-content can also be routed per scene type with composite keys:
# scene-content:slide, scene-content:quiz, scene-content:interactive,
# scene-content:pbl. A type falls back to the base scene-content route when it
# has no key of its own (so scene-content:<type> > scene-content > x-model >
# DEFAULT_MODEL).
# A route value can be a model string, OR an object {"model","thinking"} where
# `thinking` is the full ThinkingConfig: mode (default|disabled|enabled|auto),
# effort (none|minimal|low|medium|high|xhigh|max), level (minimal|low|medium|
# high, Gemini), enabled (bool), budgetTokens (number), excludeReasoningOutput
# (bool). It is normalized per the model's capability. When a stage is routed:
# a set `thinking` wins over the client's thinking; with no `thinking` the routed
# model uses its own default and the client's thinking is dropped. Unrouted
# stages keep the client thinking.
# Example: cheap default, stronger model only for the heavy/conversational stages:
# MODEL_ROUTES='{"scene-content":"openai:gpt-5.4","scene-actions":"openai:gpt-5.4","pbl-chat":"anthropic:claude-sonnet-4","chat-adapter":"anthropic:claude-sonnet-4"}'
# Example: per scene type + pinned thinking (qwen budget, deepseek off):
# MODEL_ROUTES='{"scene-content:interactive":{"model":"qwen:qwen3.7-plus","thinking":{"enabled":true,"budgetTokens":8000}},"scene-content:quiz":{"model":"deepseek:deepseek-v4-pro","thinking":{"enabled":false}}}'
# MODEL_ROUTES=

# LOG_LEVEL=info
# LOG_FORMAT=pretty
# LLM_THINKING_DISABLED=false

# Opt-in parallel scene-content generation (#572). 0/unset = serial (default).
# A value > 1 fetches scene content concurrently (capped at 10); actions + TTS
# stay serial. Leave off if your API key has a low per-key concurrency quota.
# PARALLEL_SCENE_CONCURRENCY=3

# --- Local/Self-hosted Deployment ---------------------------------------------
# Set to "true" to allow private/local network URLs (e.g. localhost, 192.168.x.x).
# Required for self-hosted models like Ollama. Do NOT enable on public deployments.
# ALLOW_LOCAL_NETWORKS=true

# Build-time, space-separated CSP frame-ancestor sources in addition to 'self'.
# Configure only origins you trust to embed OpenMAIC, then rebuild the app. The
# Docker and Compose builds also accept this value as a build argument.
# ALLOWED_FRAME_ANCESTORS=https://partner.example.com

# Optional MP4 render service (issue #866). When set, the in-app "Export Video"
# menu offers one-click MP4 rendering; when unset, it degrades to downloading a
# project ZIP for local CLI rendering. Point this at the isolated render-service
# container (see render-service/ and the "video-export" docker-compose profile).
# This is operator-supplied trusted config: the app forwards uploads to it
# without the SSRF guard, so a private/compose-network target works WITHOUT
# setting ALLOW_LOCAL_NETWORKS.
# RENDER_SERVICE_URL=http://render-service:9000

# Honor x-forwarded-for / x-real-ip when deriving render-service client identity.
# Enable only behind a trusted reverse proxy that overwrites these headers.
# TRUST_PROXY_HEADERS=true

# --- Server-backed Persistence ------------------------------------------------

# Build-time client switch and shared development token. The public token must
# match PERSISTENCE_DEV_TOKEN. This development-only scheme provides no user
# isolation and must not be used as public-production authentication.
# NEXT_PUBLIC_PERSISTENCE=1
# NEXT_PUBLIC_PERSISTENCE_TOKEN=

# Runtime PostgreSQL connection and matching development token.
# DATABASE_URL=postgres://openmaic:password@postgres:5432/openmaic
# PERSISTENCE_DEV_TOKEN=

# Store asset bytes in S3 instead of PostgreSQL. Region, endpoint, and credentials
# are resolved through the standard AWS SDK environment / credential chain.
# ASSET_S3_BUCKET=

# The asset collector is enabled by default when DATABASE_URL is configured.
# ASSET_COLLECTION_ENABLED=true
# ASSET_COLLECTION_INTERVAL_MS=900000
# ASSET_COLLECTION_GRACE_MS=3600000

# --- Access Control -----------------------------------------------------------
# Set a password to restrict site access. When set, users must enter this code
# before using the app. Leave empty or remove to disable access control. A
# dedicated role=server deployment skips this browser session gate and keeps
# its server-to-server publish endpoints on Bearer authentication.
# ACCESS_CODE=your-secret-code
# ACCESS_CODE session lifetime in seconds (default 604800 / 7 days, max 1 year).
# ACCESS_CODE_SESSION_TTL_SECONDS=604800
# Login attempts are limited in each process (default 10 per 15 minutes) with
# a bounded client map. Use a shared limiter/WAF for multi-instance deployment.
# ACCESS_CODE_RATE_LIMIT_MAX_ATTEMPTS=10
# ACCESS_CODE_RATE_LIMIT_WINDOW_SECONDS=900
# ACCESS_CODE_RATE_LIMIT_MAX_CLIENTS=10000
# Next.js does not expose a transport IP here, so the safe default is one shared
# bucket. Enable proxy headers only behind a trusted proxy that overwrites and
# strips client-supplied X-Forwarded-*/X-Real-IP values.
# ACCESS_CODE_TRUST_PROXY_HEADERS=false
# Canonical browser origin for cookie-authenticated ops mutations. Configure it
# when the ops service sits behind a reverse proxy (origin only, no path).
# OPS_PUBLIC_ORIGIN=https://ops.example.com
# QA/TTS client-IP headers are ignored unless a trusted proxy overwrites them.
# LEARNER_RATE_LIMIT_TRUST_PROXY_HEADERS=false

# Deployment capability boundary: all | ops | server | learner.
# Production defaults to learner when unset (fail closed); development/test
# defaults to all for the historical monolith experience. Ops production must
# also configure ACCESS_CODE. Set the public value to the same non-secret role
# so client affordances match the server-enforced capability boundary.
# OPENMAIC_DEPLOYMENT_ROLE=learner
# NEXT_PUBLIC_OPENMAIC_DEPLOYMENT_ROLE=learner

# Resource ownership enforcement: shadow | required.
# Keep shadow until a real account session/device-proof resolver is installed.
# In required mode, unavailable identity fails closed and legacy ownerless jobs
# must be explicitly migrated before they can be read or mutated.
# OPENMAIC_IDENTITY_ENFORCEMENT=shadow

# --- Courseware publishing (3-tier: ops → server → learner) -------------------
# A same-origin ops workbench publishes through its authenticated ACCESS_CODE
# session without exposing this token to the browser. A separate ops deployment
# publishing to an L2 server uses this server-only bearer token.
# COURSEWARE_PUBLISH_TOKEN=

# Ops only: fixed server origin for one-request large-course publication.
# It must be an origin (no credentials/path/query/fragment); the endpoint path
# is fixed in code and redirects are rejected.
# COURSE_PUBLISH_SERVER_BASE_URL=https://course-server.example.com

# Server only: canonical learner-visible origin written into bundle URLs.
# Required in production for the internal large-course publish endpoint.
# COURSEWARE_PUBLIC_BASE_URL=https://learn.example.com

# Plain HTTP to a non-loopback publish/public origin is rejected unless this is
# explicitly enabled for a trusted private network.
# COURSE_PUBLISH_ALLOW_INSECURE_HTTP=false

# Whole-course multipart cap (default 900 MiB) and ops request timeout
# (default 10 minutes). Actual streamed bytes are capped server-side.
# COURSE_PUBLISH_MAX_UPLOAD_BYTES=943718400
# COURSE_PUBLISH_TIMEOUT_MS=600000

# Where the server keeps courseware records and bundle bytes.
# Defaults to ./data/coursewares and ./data/courseware-bundles.
# COURSEWARE_DATA_DIR=

# Private Works -> Learning Engine authentication. LEARNING_ENGINE_TOKEN is
# canonical; MAKELORE_RUNTIME_TOKEN is a temporary migration alias.
# LEARNING_ENGINE_TOKEN=replace-with-a-long-random-secret
# MAKELORE_RUNTIME_TOKEN=
# One shared writable root for Engine + Learning Ops state. Mount /app/data as
# RWX when those two deployments are separate processes.
# LEARNING_DATA_DIR=/app/data
# Optional sidecar HMAC for exact aggregate/single archive bytes.
# LEARNING_PACKAGE_SIGNING_KEY=
# LEARNING_PACKAGE_SIGNING_KEY_ID=default
# MAKELORE_COURSE_PACKAGE_DIR=/app/data/makelore-packages
# MAKELORE_COURSE_STORE_DIR=/app/data/makelore-courses
# COURSEWARE_BUNDLE_DIR=

# Learning Ops build/runtime. OPENMAIC_BASE_PATH is a build-time Next basePath;
# build the Ops artifact/image with /learning-ops. Browser bearer sessions are
# introspected against Works and production never falls back to ACCESS_CODE.
# OPENMAIC_BASE_PATH=/learning-ops
# WORKS_SQUARE_API_BASE_URL=http://works-square-server:8000
# Ops runner mutations use the same Engine process as Works cancel/resume.
# Canonical value includes the private API prefix. When omitted, the existing
# COURSE_PUBLISH_SERVER_BASE_URL origin is reused with /api/runtime/v1.
# LEARNING_ENGINE_BASE_URL=http://makelore-learning-engine:3000/api/runtime/v1

# Max accepted size of each module bundle (default 300 MiB).
# COURSEWARE_MAX_UPLOAD_BYTES=314572800

# --- Large-course mode (two-layer: framework → per-module coursewares) -------
# Ops course records (data/course-frameworks) and the L2 published course
# manifest repo (data/course-manifests) written by the course-level publish
# (POST /api/courses/:id/publish, server injects the token above internally).
# COURSE_FRAMEWORK_DIR=
# COURSE_MANIFEST_DIR=
# Model routing: stage "course-framework" pins the Layer-1 framework agent to
# a dedicated model, e.g.:
# MODEL_ROUTES={"course-framework":"openai/gpt-4o-mini"}

# --- Learner Q&A assistant (single-agent, design doc §4.4) ------------------
# Per-IP sliding-window rate limits for the two controlled LLM/TTS endpoints.
# QA_RATE_LIMIT_PER_MIN=15
# TTS_RATE_LIMIT_PER_MIN=30
# QA_TTS_PROVIDER=          # default TTS provider for answer read-aloud
#                           # (falls back to the first server-configured TTS provider)
# TTS_CACHE_DIR=            # content-addressed audio cache (default ./data/tts-cache)
# Model routing: add MODEL_ROUTES JSON entry for stage "qa-assistant" to pin
# the assistant to a dedicated model, e.g.:
# MODEL_ROUTES={"qa-assistant":"openai/gpt-4o-mini"}