DATABASE_URL="file:./dev.db"

# Comma-separated hosts permitted as in-site game embeds (Phase 3 allowlist).
# "example.com" is DEMO ONLY so the seeded Block Breaker Blitz embed renders
# locally. Production must list only real authorized providers — empty = deny all.
ALLOWED_EMBED_DOMAINS="example.com"

# --- Admin panel (Phase 5). Local dev values only — change in production! ---
ADMIN_USERNAME="admin"
ADMIN_PASSWORD_HASH="v1$00105aff00ee6b9f5f827834c8e8f6b6$3cab67b582f5b0c05581aa2a1eae5c1353c83e1cc899baa22c574ac0d43e5ebac80e4377c4cd460b9e2bea902b4112bcf1e9400a1ca5945b054986efad7f93fb"
ADMIN_SESSION_SECRET="6af5424a30d8b69e3414a6f98d86ecf6b33fdb6658e62b922bc48ba4e085caec"
