feat: rebuild fiscal clone architecture and harden coolify deployment

.env.example

@@ -1,20 +1,28 @@
-# Database
+# PostgreSQL
 DATABASE_URL=postgres://postgres:postgres@localhost:5432/fiscal
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres
 POSTGRES_DB=fiscal
 POSTGRES_HOST=localhost
 
-# Backend
+# API service
 PORT=3001
 NODE_ENV=development
-JWT_SECRET=change-this-to-a-random-secret-key
-BETTER_AUTH_SECRET=change-this-to-a-random-secret-key
-BETTER_AUTH_BASE_URL=http://localhost:3001
 FRONTEND_URL=http://localhost:3000
+BETTER_AUTH_SECRET=replace-with-strong-random-secret
+BETTER_AUTH_BASE_URL=http://localhost:3001
+SEC_USER_AGENT=Fiscal Clone <support@example.com>
 
 # Frontend
 NEXT_PUBLIC_API_URL=http://localhost:3001
+# In Coolify this must be the public backend URL (e.g. https://api.fiscal.example.com)
 
-# OpenClaw Integration
-OPENCLAW_WEBHOOK_URL=https://discord.com/api/webhooks/...
+# OpenClaw / ZeroClaw (OpenAI-compatible)
+OPENCLAW_BASE_URL=http://localhost:4000
+OPENCLAW_API_KEY=replace-with-your-agent-key
+OPENCLAW_MODEL=zeroclaw
+
+# Queue tuning
+TASK_HEARTBEAT_SECONDS=15
+TASK_STALE_SECONDS=120
+TASK_MAX_ATTEMPTS=3