Upload env_additions.txt

env_additions.txt

@@ -0,0 +1,7 @@
+Add this line to your env file before deploying with real patient data:
+
+PROVIDER_TOKEN=replace_this_with_a_long_random_string
+
+If PROVIDER_TOKEN is not set, provider routes remain unprotected
+(existing behaviour, safe for local dev and demos).
+Generate a secure token with: python3 -c "import secrets; print(secrets.token_urlsafe(32))"