Deliver Step 1: Backend cleanup — secrets scrubbed, is_admin column, Telegram optional, crypto service, v4-v7 migrations, .env.example, setup.sh

.env.example

@@ -1,6 +1,13 @@
-DB_PASSWORD=change-me-strong-password
-SECRET_KEY=change-me-jwt-secret-key
-STRAVA_CLIENT_ID=
-STRAVA_CLIENT_SECRET=
-POLAR_CLIENT_ID=
-POLAR_CLIENT_SECRET=
+# === REQUIRED (generated automatically by setup.sh) ===
+SECRET_KEY=
+
+# === APP URL (change for production) ===
+BASE_URL=http://localhost
+
+# === DATABASE (defaults work out of the box) ===
+DB_USER=fitness
+DB_NAME=fitness_rewards
+
+# Everything else — Strava, Polar, Garmin, Fitbit, Telegram,
+# USDA, Groq, etc. — is configured through the app UI or your AI agent.
+# No container restart needed.