Update features and dependencies

.env.example

@@ -15,10 +15,36 @@ STORAGE_REGION=us-east-1
 BETTER_AUTH_SECRET=
 BETTER_AUTH_URL=http://localhost:3000
 
-# OAuth
+# Encryption key for BYOK AI keys stored in DB (generate with: openssl rand -base64 32)
+# Separate from BETTER_AUTH_SECRET for key separation. Falls back to BETTER_AUTH_SECRET if unset.
+ENCRYPTION_SECRET=
+
+# OAuth — Google (always available)
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 
+# OAuth — GitHub (optional; set NEXT_PUBLIC_GITHUB_ENABLED=true to show button in UI)
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+NEXT_PUBLIC_GITHUB_ENABLED=
+
+# OAuth — Discord (optional; set NEXT_PUBLIC_DISCORD_ENABLED=true to show button in UI)
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+NEXT_PUBLIC_DISCORD_ENABLED=
+
+# OIDC — Authentik (or any OIDC provider)
+# AUTHENTIK_BASE_URL: base URL including application slug, e.g.
+#   https://auth.example.com/application/o/epicure
+# The discovery document is fetched from $AUTHENTIK_BASE_URL/.well-known/openid-configuration
+# In authentik: create an OAuth2/OpenID provider, set redirect URI to
+#   $BETTER_AUTH_URL/api/auth/callback/authentik
+AUTHENTIK_CLIENT_ID=
+AUTHENTIK_CLIENT_SECRET=
+AUTHENTIK_BASE_URL=
+# Set to true to show Authentik login button in UI
+NEXT_PUBLIC_AUTHENTIK_ENABLED=
+
 # SMTP (leave blank to log emails to console in dev)
 SMTP_HOST=
 SMTP_PORT=587