Commit the AI config; there's nothing in it to hide

.cursor/config.json in the repo: baseURL is https://ai.hoody.com/api/v1, apiKey is container-cursor-dev. It's committed. The secret scanner in CI has nothing to say, because nothing in the file is a secret.

The token names a container; the gateway on your server identifies the caller by source address and never parses the suffix. A collaborator who clones the repo into their own Hoody container has AI working without editing a character. A stranger who clones it onto a laptop gets a config that returns 401.

The .env dance disappears. No .env.example with blanks, no "ask me for the key," no Slack DM with a string that later has to be rotated.