feat: code quality audit + autoresearch integration + infra hardening (#150)

.env.example

@@ -71,3 +71,23 @@
 # Requires: pip install ".[discord]"
 # Optional: pip install pyzbar Pillow  (for QR code invite detection from screenshots)
 # DISCORD_TOKEN=
+
+# ── Autoresearch — autonomous ML experiment loops ────────────────────────────
+# Enable autonomous experiment loops (Karpathy autoresearch pattern).
+# AUTORESEARCH_ENABLED=false
+# AUTORESEARCH_WORKSPACE=data/experiments
+# AUTORESEARCH_TIME_BUDGET=300
+# AUTORESEARCH_MAX_ITERATIONS=100
+# AUTORESEARCH_METRIC=val_bpb
+
+# ── Docker Production ────────────────────────────────────────────────────────
+# When deploying with docker-compose.prod.yml:
+#   - Containers run as non-root user "timmy" (defined in Dockerfile)
+#   - No source bind mounts — code is baked into the image
+#   - Set TIMMY_ENV=production to enforce security checks
+#   - All secrets below MUST be set before production deployment
+#
+# Taskosaur secrets (change from dev defaults):
+# TASKOSAUR_JWT_SECRET=<generate with: python3 -c "import secrets; print(secrets.token_hex(32))">
+# TASKOSAUR_JWT_REFRESH_SECRET=<generate with: python3 -c "import secrets; print(secrets.token_hex(32))">
+# TASKOSAUR_ENCRYPTION_KEY=<generate with: python3 -c "import secrets; print(secrets.token_hex(32))">