Prepare shop-ready deployment docs and fix transaction modal UI

server/.env.example

@@ -1,9 +1,12 @@
-# Server config (copy to server/.env or set in your shell)
+# Production API config (copy to server/.env)
+NODE_ENV=production
 PORT=4000
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/crm_omt
-JWT_SECRET=change-me-to-a-long-random-string
+BIND_HOST=127.0.0.1
+DATABASE_URL=postgres://postgres:replace-with-db-password@localhost:5432/crm_omt
+JWT_SECRET=replace-with-a-long-random-string-at-least-32-chars
 JWT_EXPIRES_IN=12h
-CORS_ORIGIN=http://localhost:5173,http://localhost:8080
 
-# Frontend clients on the same LAN can use the host machine's IP automatically.
-# Add fixed origins here if you want to restrict access more tightly.
+# Same-origin when SPA is served by this API.
+# Keep localhost/127.0.0.1 unless you intentionally expose the service behind a reverse proxy.
+CORS_ORIGIN=http://localhost:4000,http://127.0.0.1:4000
+ENABLE_LOCAL_TEST_ROUTES=0