docs: the quickstart commands no longer start, now that a receipt key is required

[nishchal-gond]

Requested by LPH · project thread

Before: #29 made OREOCHAIN_RECEIPT_KEY required, which was the right call — a throwaway key disowns every receipt at the next restart, and a holder cannot tell that from a forgery. But it turned both commands in server/README.md's "Run it" section into commands that do not run. Someone following the quickstart met an immediate exit and a refusal naming a variable the page had not mentioned, on their first minute with the project. The same page's own list of what the gateway refuses to start without — no API keys, no pinning credential, a wildcard CORS origin — did not include the key either.

After: the first block generates a receipt key beside the API key it already generated. The development block uses OREOCHAIN_EPHEMERAL_RECEIPT_KEY, which exists for exactly this case, with a paragraph on why it is development-only and what npm run dev sets. The refusal list mentions the key.

How

.env.example gets the other half of the same trap. The file ships PINATA_JWT= and OREOCHAIN_RECEIPT_KEY= as empty lines directly above the _FILE twins a compose deployment mounts, under a note saying that setting both is an error. That combination works — readSecret() at server/config.mjs:33 tests if (env[name]), so an empty line is not "set" — but it reads like a contradiction, and it is a trap in two directions: an operator who fills the plain line in while keeping the secret mount now gets a refusal to start, and anyone tightening that check to name in env, which reads like the stricter and safer version, breaks every compose deployment at once. The note now says to leave the line empty rather than delete it, and why.

No code changed. The test count is unchanged at 505.

Tests

Documentation is only worth anything if the commands in it run, so all four were run against this tree rather than read:

the development line, OREOCHAIN_EPHEMERAL_RECEIPT_KEY=true	starts, /health answers
the deployment shape, a generated OREOCHAIN_RECEIPT_KEY	starts, /health answers
both OREOCHAIN_RECEIPT_KEY and _FILE set	refused by name, exit 1
an empty OREOCHAIN_RECEIPT_KEY= line beside a _FILE mount	starts, which is what .env.example now promises