Harden deployment security

.env.example

@@ -7,6 +7,13 @@ SECONDARY_DOMAIN=debbiewindler.com
 # Generate a long random value before production.
 SESSION_SECRET=replace-with-a-long-random-secret
 
+# Required before the first owner account can be created.
+# Open /admin/setup?token=the-value-here during first setup.
+SETUP_TOKEN=replace-with-a-long-random-one-time-setup-token
+
+# Use "loopback" when a local reverse proxy such as Caddy/Nginx forwards to Node.
+TRUST_PROXY=loopback
+
 # SQLite and local file storage.
 DATABASE_PATH=./storage/site.sqlite
 UPLOAD_DIR=./public/uploads