Update configuration and README for improved setup and security; disable default API and emoji sync, and enhance Discord permission checks in API routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

dashboard/.env.example

@@ -0,0 +1,24 @@
+# Bot API URL (server-side — used by Next.js proxy and SSR)
+DASHBOARD_API_URL=http://127.0.0.1:8000/api/v1
+
+# Bot API key (SERVER ONLY — never use NEXT_PUBLIC_ prefix)
+DASHBOARD_API_KEY=generate_a_long_random_secret_here
+
+# Legacy/public API URL (optional fallback for DASHBOARD_API_URL)
+NEXT_PUBLIC_API_URL=http://127.0.0.1:8000/api/v1
+
+# NextAuth Configuration
+NEXTAUTH_URL=http://localhost:3000/
+NEXTAUTH_SECRET=generate_a_long_random_secret_here
+
+# Discord OAuth configuration
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+
+# Dashboard admin user IDs (comma separated — your Discord user ID)
+ADMIN_IDS=YOUR_DISCORD_USER_ID_HERE
+NEXT_PUBLIC_ADMIN_IDS=YOUR_DISCORD_USER_ID_HERE
+
+# Customizable Brand / Bot name shown across the dashboard
+NEXT_PUBLIC_BRAND_NAME="ZyroX"
+NEXT_PUBLIC_BRAND_NAME_WORD="ZX"