chore: mark WAOS env var prefix as legacy

WAOS_ prefix is kept for compatibility (legacy acronym for weareopensource).
Add parenthetical note in README, skills and agent — aligned with Vue stack treatment.

Author: PierreBrisorgueil

.claude/agents/stack-maintainer.md

@@ -16,7 +16,7 @@ You are the stack maintainer agent. Your role is to protect the mergeability and
 - **Secret leakage**: Check for accidentally committed secrets, tokens, or credentials
 - **Broad permissions**: Review permission changes for security risks
 - **Dependencies**: Flag suspicious or risky dependency additions
-- **Env vars**: Ensure sensitive config uses `WAOS_NODE_*` env vars, not hardcoded values
+- **Env vars**: Ensure sensitive config uses `WAOS_NODE_*` env vars (legacy prefix), not hardcoded values
 - **Auth bypass**: Watch for changes that weaken JWT/Passport validation or policy middleware
 
 ### 3. Verify modularity

.claude/skills/feature/SKILL.md

@@ -72,6 +72,6 @@ npm test
 
 ## Notes
 
-- Config is loaded from `config/` and overridable via `WAOS_NODE_*` env vars
+- Config is loaded from `config/` and overridable via `WAOS_NODE_*` env vars (legacy prefix kept for compatibility)
 - Authentication is handled via Passport JWT middleware — don't reimplement
 - All policies must use `lib/middlewares/policy.js` patterns

README.md

@@ -113,7 +113,7 @@ GITHUB_TOKEN=xxx npm run release:auto             # Semantic release (CI)
 
 Configuration files live in `config/defaults/`. The `development.js` file is the base; other files in that folder override it.
 
-Environment variables prefixed with `WAOS_NODE_` are merged on top. The variable path maps directly to the config object key:
+Environment variables prefixed with `WAOS_NODE_` are merged on top (`WAOS` is a legacy prefix kept for compatibility). The variable path maps directly to the config object key:
 
 ```bash
 WAOS_NODE_app_title='my app'               # sets config.app.title