Update configuration and README for improved setup and security; disable default API and emoji sync, and enhance Discord permission checks in API routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

bot/.env.example

@@ -0,0 +1,43 @@
+TOKEN=TOKEN_HERE
+brand_name='ZyroX'
+NEXT_PUBLIC_BRAND_NAME='ZyroX'
+
+# ── Owner / Staff IDs (REQUIRED — comma-separated Discord user IDs) ───────────
+# Set your own Discord user ID(s). No foreign IDs are used as fallback.
+OWNER_IDS=YOUR_DISCORD_USER_ID_HERE
+
+# ── Optional: debug REPL for owners (disabled by default) ─────────────────────
+JISHAKU_ENABLED=false
+
+# ── Optional: Discord log / stats channels (leave empty to disable) ───────────
+# LOG_CHANNEL_ID=
+# SERVER_COUNT_CHANNEL_ID=
+# USER_COUNT_CHANNEL_ID=
+
+# ── Lavalink ──────────────────────────────────────────────────────────────────
+LAVALINK_HOST="lavalink.jirayu.net"
+LAVALINK_PASSWORD="youshallnotpass"
+LAVALINK_SECURE="false"
+LAVALINK_PORT="13592"
+
+# ── Emoji Sync ────────────────────────────────────────────────────────────────
+EMOJI_SYNC="false"
+
+# ── API / Dashboard Backend ───────────────────────────────────────────────────
+API_ENABLED="false"
+API_HOST="127.0.0.1"
+API_PORT="8000"
+DASHBOARD_API_KEY="generate_a_long_random_secret_here"
+# Discord user IDs allowed to use /api/v1/admin (comma-separated; falls back to OWNER_IDS)
+DASHBOARD_ADMIN_IDS=YOUR_DISCORD_USER_ID_HERE
+CORS_ORIGINS=""
+
+# ── Webhooks (leave empty or unset to disable command logging) ────────────────
+# CMD_WEBHOOK_URL must be a full Discord webhook URL to enable logging.
+# CMD_WEBHOOK_URL=
+
+# ── Cloudflare Tunnel (disabled by default) ───────────────────────────────────
+TUNNEL_ENABLED="false"
+TUNNEL_ALLOW_BINARY_DOWNLOAD="false"
+# CF_TUNNEL_TOKEN=
+# CF_TUNNEL_URL=