deps(python): update fastmcp requirement from >=0.1.0 to >=3.4.4

.env.example

@@ -1,41 +1,47 @@
 # VaultWatch Environment Variables
 # Copy to .env and fill in your values
+# DO NOT commit .env to version control
 
-# Groq API (required)
-GROQ_API_KEY=your_groq_api_key_here
+# ── Groq AI (server-side only — never expose to browser) ──────────────────
+GROQ_API_KEY=gsk_your_groq_api_key_here
 
-# Casper Network
-CASPER_NODE_URL=https://node.testnet.casper.network/rpc
+# ── Casper Network ─────────────────────────────────────────────────────────
+CASPER_NODE_URL=http://node.testnet.casper.network
+CASPER_RPC_URL=https://node.testnet.casper.network/rpc
 CASPER_CHAIN_NAME=casper-test
-CASPER_ACCOUNT_SECRET_KEY=your_secret_key_hex_here
-
-# Casper Sidecar SSE
-CASPER_SIDECAR_URL=http://127.0.0.1:18888/events/main
-
-# CSPR.cloud API
-CSPR_CLOUD_API_URL=https://api.testnet.cspr.cloud
-CSPR_CLOUD_API_KEY=your_cspr_cloud_key_here
-
-# Deployed Contract Hashes (filled after deployment)
-CONTRACT_AUDIT_TRAIL=
-CONTRACT_RISK_ORACLE=
-CONTRACT_SENTINEL_CREDIT=
-CONTRACT_SENTINEL_REGISTRY=
-CONTRACT_ALERT_LOG=
-CONTRACT_AGENT_BEHAVIOR_INDEX=
-CONTRACT_RISK_POLICY_MANAGER=
-CONTRACT_SUBSCRIBER_VAULT=
-
-# x402 Pay-per-query
-X402_PAYMENT_AMOUNT=1000000  # 0.001 CSPR in motes
-
-# OpenTelemetry (optional — stdout used if not set)
-OTEL_EXPORTER_OTLP_ENDPOINT=
+# Path to your operator SECP256K1 secret key PEM file
+CASPER_SIGNING_KEY_PATH=/path/to/secret_key.pem
+
+# ── CSPR.cloud (server-side only — proxied via /api/chain) ─────────────────
+# Fix #6: key lives here, never in the browser bundle
+CSPR_CLOUD_API_KEY=your_cspr_cloud_api_key_here
+
+# ── Contract Hashes (Casper testnet) ──────────────────────────────────────
+AUDIT_TRAIL_HASH=b9c70cdceff1011008b3933835d4a46146f26f1d1e82ada8520be77e1d6333a7
+SENTINEL_REGISTRY_HASH=9a5eb4f83de8cbfef4f389516b977258b0e1d63179b288ca623a860fc6ec346c
+RISK_ORACLE_HASH=e071aacc460a62e538092f5006930710f49e632598846c4c843e3daf0c5a7c9d
+SENTINEL_CREDIT_HASH=0c09f2ad66701b38b1720390e20bf8ac5b7bf6a20cc174cba44f3861549baf71
+AGENT_BEHAVIOR_INDEX_HASH=05066c33ddb73b523ab8f67275ca6096254f9d1832e76075d1e5f41f188b7dd0
+SENTINEL_ALERT_LOG_HASH=53317e080ffdffcf097447ea3375c9195c6936fe7b1ed53795bf46134322a925
+RISK_POLICY_MANAGER_HASH=93e35d6488dcab8524a22c82241c7ddc6d07b0f7c011544e6c4a296c1a0eee2e
+SUBSCRIBER_VAULT_HASH=6620787c14d9d78506b281be8c95c8f9b105781b9705d2bd9736f2aabfd6956d
+
+# ── x402 Payments ──────────────────────────────────────────────────────────
+X402_QUERY_PRICE_MOTES=1000000000
+X402_PREMIUM_PRICE_MOTES=5000000000
+
+# ── API Security ───────────────────────────────────────────────────────────
+# Fix #16: API key for protected endpoints
+VAULTWATCH_API_KEY=your_strong_api_key_here
+
+# ── CORS ────────────────────────────────────────────────────────────────────
+# Comma-separated list of allowed origins (or * for dev)
+CORS_ORIGINS=http://localhost:5173,https://dashboard-rho-amber-89.vercel.app
+
+# ── RWA Data Sources ────────────────────────────────────────────────────────
+DEFILLAMA_API_URL=https://api.llama.fi
+CHAINLINK_ETH_RPC=https://eth.llamarpc.com
+
+# ── OpenTelemetry (optional) ────────────────────────────────────────────────
 OTEL_SERVICE_NAME=vaultwatch
-
-# API Server
-API_HOST=0.0.0.0
-API_PORT=8000
-
-# Dashboard
-VITE_API_URL=http://localhost:8000
+OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317