fix: stop baking Supabase anon key into the Docker image

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/RUNBOOK.md

@@ -1,20 +1,30 @@
 # Runbook — Centro de Mando 4Ventures
 
-Operador: `marketing@4ventures.es`
+Operador: `marketing@4ventures.es`  
+Credenciales locales (gitignored): `.ops/marketing-credentials.txt`
 
 ## Health
 
 ```bash
 curl -sf https://app.4ventures.es/api/health
+# expect: serviceRoleConfigured true
 ./scripts/smoke.sh https://app.4ventures.es
+python3 scripts/smoke_operator_login.py
+python3 scripts/smoke_chat_auth.py
 ```
 
 ## Deploy (Dokploy)
 
 1. Push a `main` en Gitea `Marketing/4ventures-client-portal`.
-2. Dokploy rebuild del servicio `app`.
-3. Env: `NEXT_PUBLIC_SUPABASE_*`, `SUPABASE_SERVICE_ROLE_KEY`, `ANTHROPIC_API_KEY`.
-4. Smoke: `/login` → KPIs → simulador → chat.
+2. Dokploy → **Web4Ventures / production / client-portal** → Deploy  
+   (id interno `web4ventures-clientportal-jntjhs`).
+3. Environment (runtime + build via “Create Environment File”):
+   - `NEXT_PUBLIC_SUPABASE_URL`
+   - `NEXT_PUBLIC_SUPABASE_ANON_KEY`
+   - `SUPABASE_SERVICE_ROLE_KEY`
+   - `ANTHROPIC_API_KEY` (opcional, LLM)
+4. Traefik: `portal.yml` → `http://web4ventures-clientportal-jntjhs:3000`
+5. Smoke: `/login` → KPIs → creatividades → chat.
 
 ## Alta cliente
 
@@ -28,6 +38,10 @@ UI `/dashboard/agencia` (roles admin/team) o RPC `provision_client`.
 
 `POST https://n8n-agencia.4ventures.es/webhook/lead-inbound`
 
+## Endurecer git / n8n
+
+Ver `.ops/HARDEN_SURFACES.md` (IP allowlist; no aplicado hasta tener IPs).
+
 ## Incidentes
 
 Ver `SECURITY.md`.