docs: add Vite Gemini + OCR env vars

Author: paccloud

docs/ENVIRONMENT_VARIABLES.md

@@ -34,14 +34,21 @@ These are bundled into the client code and exposed to the browser:
 - `VITE_STACK_PROJECT_ID` - Stack Auth project ID
 - `VITE_STACK_PUBLISHABLE_CLIENT_KEY` - Stack Auth public key
 - `VITE_API_URL` - API base URL (empty for production, http://localhost:3000 for dev)
+- `VITE_GEMINI_API_KEY` - **Required**; Gemini API key used for Gemini integration and bundled into client code (e.g. `AIza...`)
+- `VITE_OCR_ENDPOINT` - **Optional**; custom OCR backend endpoint URL (default: use the app's built-in OCR flow/config if unset; e.g. `http://localhost:3000/api/ocr`)
 
 ### Backend (Vercel Functions) - Server-side only
+
 These are only accessible on the server:
 - `STACK_PROJECT_ID` - Stack Auth project ID (server-side)
 - `STACK_SECRET_SERVER_KEY` - Stack Auth secret key (**NEVER expose to client**)
-- `JWT_SECRET` - Secret for signing JWT tokens
+- `JWT_SECRET` - Secret for signing JWT tokens (required; API/server will fail fast if missing)
+- `JWT_EXPIRES_IN_SECONDS` - Optional; JWT lifetime in seconds (default 86400 / 24h)
+- `ALLOWED_ORIGINS` - Comma-separated allowlist for CORS (e.g. `https://your-app.vercel.app,http://localhost:5173`)
+- `CORS_ALLOW_CREDENTIALS` - Set to `true` only if you need to send cookies with cross-origin requests
 - `DATABASE_URL` - PostgreSQL connection string
 - All `POSTGRES_*` and `PG*` variables from Neon
+- `GEMINI_API_KEY` - **MUST be server-side only** (no `VITE_` prefix); Gemini API key for AI features (e.g., spreadsheet parsing). **NEVER expose to client code**. All Gemini API calls must be routed through server endpoints (e.g., `/api/parse-spreadsheet`) - the browser should never have direct access to this key.
 
 ## Common Issues
 
@@ -76,6 +83,8 @@ If you get 401 Unauthorized errors when logged in with OAuth:
 
 3. Never commit `.env`, `.env.development`, or `.env.production` files - they're gitignored for security.
 
+4. For the local Express server (`server/server.js`), create `server/.env` (or `.env.local`) with `JWT_SECRET` and `ALLOWED_ORIGINS` that match your dev URLs. See `server/.env.example` for defaults.
+
 ## Production Deployment
 
 Environment variables for production are managed in Vercel: