feat: SDLC database separation for CI/testing (#35)

## Summary
- Fix `isProductionDatabase()` to allow CI database (`euchre_camp_ci`)
- Add database schema reset before CI test runs
- Create `global.teardown.ts` for cleanup (CI: full reset, dev/prod: selective cleanup)
- Add `acceptance-tests` job to PR workflow with CI database
- Create `sync-prod-to-dev.js` script for one-way prod→dev sync
- Add `just` recipes: `sync-dev`, `test-prod`, `reset-ci-db`
- Store credentials in `.credentials` (gitignored) with unique CI user

## Testing
Verified against CI database:
- Schema reset works
- Migrations apply correctly
- Test users created successfully
- 219 tests pass (slow but working)

## Next Steps
- Set `CI_DATABASE_URL` as Gitea repository variable

Reviewed-on: #35
Co-authored-by: David Gwilliam <dhgwilliam@gmail.com>
Co-committed-by: David Gwilliam <dhgwilliam@gmail.com>

.env.example

@@ -1,54 +1,48 @@
 # EuchreCamp Environment Configuration
-# Copy this file to .env and fill in your values
+# ============================================
+# Copy this file to .env (for local dev) or use
+# .env.development / .env.ci for specific environments
 
 # ============================================
 # Database Configuration
 # ============================================
-# PostgreSQL connection string
-# Format: postgresql://username:password@host:port/database
-DATABASE_URL=postgresql://euchre:euchrepassword@localhost:5432/euchre_camp
+# IMPORTANT: Use the appropriate DATABASE_URL for your environment:
+#
+# - Development (ephemeral, synced from prod):  euchre_camp_dev
+# - CI/Testing (reset before each run):        euchre_camp_ci  
+# - Production (DO NOT USE FOR TESTS):         euchre_camp
+#
+# The .credentials file in the project root contains
+# the actual connection strings - DO NOT commit .credentials
 
-# Shadow database for Prisma migrations (optional for PostgreSQL)
-DATABASE_SHADOW_URL=postgresql://euchre:euchrepassword@localhost:5432/euchre_camp_shadow
-
-# Database provider (postgresql)
 DATABASE_PROVIDER=postgresql
 
 # ============================================
 # Better Auth Configuration
 # ============================================
-# Secret key for session encryption (generate a strong random string)
-# Run: openssl rand -base64 32
-BETTER_AUTH_SECRET=your-secret-key-change-in-production
+# Generate a new secret with: openssl rand -base64 32
+BETTER_AUTH_SECRET=generate-new-secret-in-production
 
-# Base URL for authentication callbacks
-# For production: https://your-domain.com
+# Base URL - update for production
 BETTER_AUTH_URL=http://localhost:3000
 
 # ============================================
 # Application Configuration
 # ============================================
-# Environment: development, production, test
-NODE_ENV=production
+NODE_ENV=development
 
-# Trusted origins for CORS and authentication
-# Add your domain(s) for production
+# Comma-separated list of trusted origins
 TRUSTED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
 
 # ============================================
-# Optional: External Services
+# Environment-Specific Overrides
 # ============================================
-# If using external database (e.g., Supabase, Railway)
-# DATABASE_URL=postgresql://user:pass@host:port/db
-
-# If using external auth provider
-# BETTER_AUTH_URL=https://your-app.com
-
-# ============================================
-# CasaOS Deployment Notes
-# ============================================
-# When deploying to CasaOS, set these via the UI:
-# 1. DATABASE_URL: Your PostgreSQL connection string
-# 2. BETTER_AUTH_SECRET: Generate with: openssl rand -base64 32
-# 3. BETTER_AUTH_URL: Your app's public URL
-# 4. TRUSTED_ORIGINS: Your app's public URL(s)
+# For development (.env.development):
+#   DATABASE_URL from .credentials (euchre_camp_dev)
+#   NODE_ENV=development
+#   BETTER_AUTH_URL=http://localhost:3000
+#
+# For CI (.env.ci):
+#   DATABASE_URL from .credentials (euchre_camp_ci)
+#   NODE_ENV=test
+#   BETTER_AUTH_URL=http://localhost:3000