Security

• No secrets in source control. Use `.env.local` only.
• Service-role keys stay server-side.
• CRM credentials are referenced, never inlined.
• Admin mutations write an audit log.