Remove stale runner and deployment instructions after monorepo cleanup

.gitignore

@@ -24,9 +24,6 @@ __pycache__/
 # Approved, versioned brand resources are package source assets.
 !packages/brand/assets/**/*.png
 !packages/brand/docs/logo-preview.png
-/apps/studio/public/brand/
-/apps/studio/public/favicon.ico
-/apps/studio/public/apple-touch-icon.png
 /apps/dashboard/public/brand/
 /apps/dashboard/public/favicon.ico
 /apps/dashboard/public/apple-touch-icon.png

apps/dashboard/ACCOUNT.md

@@ -1,6 +1,7 @@
 # Email accounts
 
-`/account` offers registration, password login, email verification/resend, and logout.
+`/account` offers registration, password login, email verification/resend, password
+recovery, and logout.
 `/api/account/session` returns the current account; other actions use same-origin POST.
 Passwords require at least 12 characters and at most 256 UTF-8 bytes. Only verified
 accounts can log in. Verification links expire after 30 minutes and are consumed once.
@@ -9,24 +10,22 @@ Only token SHA-256 digests are stored. Passwords use individually salted scrypt.
 
 ## Runtime configuration
 
-The existing production deployment reads `/etc/prompt.env` on ces-control. Set its
-ownership to root and mode to 0600. The operator should update SMTP_PASSWORD there
-through a secure remote session, without putting it in command arguments, repository,
-CI output, release.env, or chat. Existing compose deployment reads this file without
-copying credentials into the release directory. Do not run `docker compose config`
-without `--quiet` against the production environment because interpolation shows secrets.
-Docker administrators can inspect container environment; access to Docker is privileged.
+Use [the environment example](.env.example) and the root README to configure the Web,
+bootstrap, and worker processes. The repository no longer supplies CI/CD or Compose
+deployment configuration. Keep SMTP_PASSWORD and other credentials in the process
+environment or an operator-managed private file with restricted permissions, outside
+the repository. Do not put credentials in command arguments, logs, or chat.
 
-Set ACCOUNT_PUBLIC_ORIGIN to the exact browser origin and SMTP_HOST=smtpdm.aliyun.com,
-SMTP_PORT=465, SMTP_USERNAME and SMTP_FROM=noreply@notice.entroia.com. TLS certificate
+Set ACCOUNT_PUBLIC_ORIGIN to the exact browser origin and configure SMTP_HOST,
+SMTP_PORT, SMTP_USERNAME, SMTP_FROM, and SMTP_PASSWORD for the mail provider. TLS certificate
 validation stays enabled. Missing SMTP configuration returns a generic service failure;
 resend with the registration password can recover an account whose initial delivery failed.
 
 Keep AUTH_CONFIG_FILE configured for administrator access. Missing administrator
 configuration fails closed. AUTH_DISABLED_FOR_TESTS is false by default and is enabled
-only by the disposable legacy integration stack; never enable it in production.
+only for an explicitly isolated test environment; never enable it in production.
 Email account cookies never satisfy administrator authorization. With the current HTTP
-acceptance origin use AUTH_COOKIE_SECURE=false; use true after enabling HTTPS.
+runtime origin use AUTH_COOKIE_SECURE=false; use true for HTTPS.
 
 Limits persist in PostgreSQL: 10 logins and 3 registration/resend attempts per email per
 15 minutes, plus 300 requests per 15 minutes globally. ACCOUNT_TRUST_PROXY defaults
@@ -37,13 +36,16 @@ response for existing/unknown emails, and login uses a dummy KDF for unknown acc
 The rate limit itself can reveal recent activity for a known email; it does not reveal
 whether an account exists. Synchronous SMTP latency can still expose a timing side channel;
 a durable asynchronous mail queue would be needed to fully decouple delivery timing.
-Logout remains available when login/mail limits are exhausted. No password recovery or
-account deletion is included.
+Logout remains available when login/mail limits are exhausted. Password recovery uses
+a single-use reset link that expires after 30 minutes; resetting the password revokes
+existing sessions. Account deletion is not included.
 
 ## Verification
 
-ces-control runs crypto/origin tests, PostgreSQL verification-token replay races,
-expired/revoked sessions, concurrent limit consumption and unverified login rejection.
-Production-auth exercises verify that account cookies cannot authorize legacy writes.
-Actual SMTP delivery and visual acceptance at http://8.211.154.134:18131/account require
-operator runtime configuration and the normal manually approved deployment.
+There is no automatic verification pipeline. Turbo dry-runs only verify task planning;
+they do not exercise account behavior. Runtime verification requires an explicitly
+authorized environment with PostgreSQL and SMTP configuration. Cover token replay,
+expired/revoked sessions, concurrent limits, password recovery, and rejection of
+unverified logins. Verify separately that account cookies cannot authorize administrator
+writes, that real email is delivered, and that the account page works in a browser.
+Report the checks actually executed; merging into `dev` does not deploy the application.

apps/dashboard/src/components/Brand.tsx

@@ -1,4 +1,4 @@
-/** The approved mark is copied from @endoleap/brand during the remote build. */
+/** The approved mark is copied from @endoleap/brand by brand:prepare. */
 export function Brand({ compact = false, markOnly = false }: { compact?: boolean; markOnly?: boolean }) {
   return <span className="endoleap-brand"><img src="/brand/logo-light.svg" className="endoleap-mark endoleap-mark-light" alt="" width={32} height={32}/><img src="/brand/logo-dark.svg" className="endoleap-mark endoleap-mark-dark" alt="" width={32} height={32}/>{!markOnly && <span className="endoleap-wordmark">啡跃{!compact && <small>Endoleap</small>}</span>}</span>;
 }

apps/dashboard/src/studio/components/Brand.tsx

@@ -1,4 +1,4 @@
-/** The approved mark is copied from @endoleap/brand during the remote build. */
+/** The approved mark is copied from @endoleap/brand by brand:prepare. */
 export function Brand({ compact = false }: { compact?: boolean }) {
   return <span className="endoleap-brand"><img src="/studio/brand/logo-light.svg" className="endoleap-mark endoleap-mark-light" alt="" width={32} height={32}/><img src="/studio/brand/logo-dark.svg" className="endoleap-mark endoleap-mark-dark" alt="" width={32} height={32}/><span className="endoleap-wordmark">啡跃{!compact && <small>Endoleap</small>}</span></span>;
 }

packages/brand/scripts/prepare-app.mjs

@@ -1,4 +1,4 @@
-// Run in the confirmed remote build (or an explicitly authorized dev environment).
+// Called by the consuming application's dev and build scripts.
 import { copyFile, mkdir, readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 const app = JSON.parse(await readFile('package.json', 'utf8'));