chore: add .env.example

Documents every environment variable read by server/index.cjs and the Vite
frontend (grep-verified against process.env.* / import.meta.env.* usage),
with placeholder values only — no real secrets. Not gitignored (.gitignore
already carves out an exception for it).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,96 @@
+# ==============================================================================
+# Frontend (Vite) — exposed to the browser bundle, never put secrets here
+# ==============================================================================
+# VITE_API_BASE_URL=https://your-backend-domain.example.com/api
+VITE_API_BASE_URL=http://localhost:8000/api
+VITE_MIDTRANS_CLIENT_KEY=Mid-client-xxxxxxxxxxxxxxxx
+
+VITE_MIDTRANS_ENV=sandbox
+VITE_LOG_LEVEL=info
+VITE_PAYMENT_GATEWAY_MODE=snap
+
+VITE_ENABLE_BANK_TRANSFER=true
+VITE_ENABLE_CREDIT_CARD=true
+VITE_ENABLE_GOPAY=true
+VITE_ENABLE_CSTORE=true
+VITE_ENABLE_CPAY=false
+
+# ==============================================================================
+# Midtrans (server-side)
+# ==============================================================================
+MIDTRANS_SERVER_KEY=Mid-server-xxxxxxxxxxxxxxxx
+MIDTRANS_CLIENT_KEY=Mid-client-xxxxxxxxxxxxxxxx
+MIDTRANS_IS_PRODUCTION=false
+
+# ==============================================================================
+# Core payment method toggles (server-side)
+# ==============================================================================
+ENABLE_BANK_TRANSFER=true
+ENABLE_CREDIT_CARD=true
+ENABLE_GOPAY=true
+ENABLE_CSTORE=true
+
+# ==============================================================================
+# Logging
+# ==============================================================================
+LOG_LEVEL=info
+LOG_TO_FILE=true
+LOG_TO_CONSOLE=true
+# Max number of recent log entries kept in memory for GET /api/logs
+LOG_BUFFER_SIZE=1000
+
+# Exposes GET /api/logs, /api/logs/files, /api/logs/files/:filename, /api/logs/view.
+# WARNING: defaults to true if unset — set to false unless you also configure
+# LOG_BASIC_AUTH_USER/PASS below.
+LOG_EXPOSE_API=false
+# Required in production to protect the log endpoints (HTTP Basic Auth, browser-native prompt).
+# Leaving these empty only works in non-production NODE_ENV.
+LOG_BASIC_AUTH_USER=
+LOG_BASIC_AUTH_PASS=
+# Delete LOGS_*.log files older than this many days
+LOG_RETENTION_DAYS=30
+
+# ==============================================================================
+# ERP integration
+# ==============================================================================
+ERP_NOTIFICATION_URL=https://erp.example.com/callback/
+# Optional: multiple ERP endpoints, comma-separated. Overrides ERP_NOTIFICATION_URL if set.
+# ERP_NOTIFICATION_URLS=https://erp1.example.com/callback/,https://erp2.example.com/callback/
+# Used both as the client identifier AND (via fallback) the HMAC secret for ERP notification
+# signatures — set ERP_CLIENT_SECRET separately only if your ERP uses a different signing key.
+ERP_CLIENT_ID=changeme-erp-client-id
+# ERP_CLIENT_SECRET=
+ERP_ENABLE_NOTIF=true
+
+# ==============================================================================
+# Payment link signing & external API access
+# ==============================================================================
+# Required by /createtransaksi and POST /api/payment-links (X-API-KEY header). Generate with:
+# node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
+EXTERNAL_API_KEY=changeme-generate-a-strong-random-key
+# HMAC secret that signs shareable payment link tokens. Generate with:
+# node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"
+PAYMENT_LINK_SECRET=changeme-generate-a-strong-random-secret
+# Base URL the generated payment links point to (your frontend's /pay route)
+# PAYMENT_LINK_BASE=https://your-frontend-domain.example.com/pay
+PAYMENT_LINK_BASE=http://localhost:5173/pay
+PAYMENT_LINK_TTL_MINUTES=1440
+
+# ==============================================================================
+# CORS — comma-separated list of allowed frontend origins.
+# Leaving this unset allows all origins (fine for local dev, NOT recommended in production).
+# ==============================================================================
+# CORS_ALLOWED_ORIGINS=https://your-frontend-domain.example.com
+
+# ==============================================================================
+# Rate limiting for /createtransaksi, /api/payment-links, /api/payments/charge,
+# /api/payments/snap/token
+# ==============================================================================
+RATE_LIMIT_WINDOW_MS=60000
+RATE_LIMIT_MAX=20
+
+# ==============================================================================
+# Server
+# ==============================================================================
+NODE_ENV=development
+PORT=8000