docs: add diarization backend configuration

.env.example

@@ -1,12 +1,8 @@
 APP_NAME=MediaRouter
 APP_VERSION=1.0.0
-# Docker sets this to production. Local development keeps development so the
-# established SQLite workflow remains available.
 APP_ENVIRONMENT=development
 HOST=0.0.0.0
 PORT=7860
-# Comma-separated exact origins. Production requires at least one HTTPS origin
-# such as the separately hosted Vercel frontend; wildcard origins are rejected.
 CORS_ALLOWED_ORIGINS=http://localhost:3000
 TEMP_DIR=./temp
 OUTPUT_DIR=./outputs
@@ -15,7 +11,6 @@ MAX_UPLOAD_SIZE=1073741824
 WHISPER_MODEL=small
 CLEANUP_MINUTES=60
 CLEANUP_INTERVAL_SECONDS=60
-# Canonical workspace-level asset retention; project-attached assets are exempt.
 MEDIA_ASSET_RETENTION_HOURS=24
 MAX_WORKERS=2
 LOG_LEVEL=INFO
@@ -24,15 +19,13 @@ MAX_RESOLUTION_PIXELS=33177600
 DOWNLOAD_TIMEOUT_SECONDS=300
 ALLOW_PRIVATE_URLS=false
 BASE_URL=
+MEDIA_SIGNING_SECRET=
+MEDIA_SIGNED_URL_TTL_SECONDS=3600
 FFMPEG_BINARY=ffmpeg
 FFPROBE_BINARY=ffprobe
 AUTH_ENABLED=true
 DATABASE_URL=sqlite+aiosqlite:///./data/mediarouter.db
-# SQLite initializes this schema locally. PostgreSQL must receive the SQL files
-# under app/security/migrations/ through your deployment migration process.
 SECURITY_AUTO_MIGRATE=false
-# PostgreSQL only: backend-only BYPASSRLS role used for authoritative users,
-# memberships, API-key principals, and canonical asset records.
 SECURITY_DATABASE_ROLE=mediarouter_security_service
 SECURITY_ENFORCE_RLS=true
 AUTH_ROLE_SCOPES={}
@@ -46,20 +39,23 @@ AUTH_DEFAULT_CONCURRENT_JOBS=10
 AUTH_DEFAULT_UPLOADS_PER_HOUR=20
 AUTH_DEFAULT_PROCESSING_BYTES_PER_DAY=107374182400
 AUTH_TRUST_PROXY_HEADERS=true
-# Required only when running the standalone stdio MCP transport with auth enabled.
 MCP_STDIO_API_KEY=
 
-# Social Automation Foundation. Apply all SQL files under app/social/migrations/
-# to Supabase/Postgres before enabling social writes in production. The existing
-# DATABASE_URL remains a local-development fallback only.
+# Optional remote speaker-diarization backend. The backend receives the first
+# Whisper input as an authenticated octet-stream and returns either:
+# [{"speaker":"SPEAKER_00","start":0.0,"end":1.2}, ...]
+# or {"spans":[...]}.
+# Leave DIARIZATION_URL empty to keep automatic diarization unavailable.
+DIARIZATION_URL=
+DIARIZATION_API_KEY=
+DIARIZATION_CONNECT_TIMEOUT_SECONDS=10
+DIARIZATION_TIMEOUT_SECONDS=300
+DIARIZATION_MAX_INPUT_BYTES=1073741824
+DIARIZATION_MAX_RESPONSE_BYTES=1048576
+
 SOCIAL_ENABLED=true
-# Example: postgresql+asyncpg://postgres:password@db.example:5432/postgres
 SOCIAL_DATABASE_URL=
-# Required for PostgreSQL production. This URL must authenticate as a normal
-# non-owner/non-BYPASSRLS API role. Do not use a Supabase service-role URL here.
 SOCIAL_TENANT_DATABASE_ROLE=mediarouter_tenant
-# Trusted backend-only worker connection. It must use the explicitly named
-# BYPASSRLS role and must never be exposed through REST, MCP, n8n, SDKs, or UI.
 SOCIAL_WORKER_DATABASE_URL=
 SOCIAL_WORKER_DATABASE_ROLE=mediarouter_social_worker
 SOCIAL_ENFORCE_RLS=true
@@ -72,34 +68,21 @@ SOCIAL_OAUTH_REQUESTS_PER_HOUR=30
 SOCIAL_PUBLISH_REQUESTS_PER_MINUTE=30
 SOCIAL_SCHEDULE_REQUESTS_PER_MINUTE=60
 SOCIAL_ANALYTICS_REQUESTS_PER_MINUTE=120
-# Required for OAuth state/PKCE and encrypted local token fallback. Generate at
-# least 32 random bytes, for example: openssl rand -base64 32
 SOCIAL_OAUTH_ENCRYPTION_KEY=
 SUPABASE_URL=
 SUPABASE_SERVICE_ROLE_KEY=
 SUPABASE_VAULT_ENABLED=false
 SOCIAL_OAUTH_REDIRECT_BASE_URL=
 
-# Provider-neutral generation runtime. WAN and FLUX are optional; neither is
-# enabled merely by the shared timeout/retry settings below.
 GENERATION_ENABLED=true
 GENERATION_JOB_RETRY_LIMIT=3
-# Shared remote AI worker client defaults. No worker is configured by these
-# values alone; do not add browser-visible worker URLs or credentials here.
 AI_WORKER_CONNECT_TIMEOUT_SECONDS=10
 AI_WORKER_REQUEST_TIMEOUT_SECONDS=60
 AI_WORKER_READ_TIMEOUT_SECONDS=300
 AI_WORKER_MAX_RETRIES=3
 AI_WORKER_RETRY_BACKOFF_SECONDS=0.5
-# Optional authenticated WAN 2.2 image-to-video worker. Set both values only
-# in backend/Hugging Face deployment secrets; never expose them to a browser,
-# MCP client, n8n node, SDK output, or logs. WAN stays unavailable if either
-# value is omitted or malformed, without blocking application startup.
 WAN_SPACE_URL=
 WAN_SPACE_TOKEN=
-# Optional authenticated FLUX.2 Klein image-generation worker. Set both
-# backend-only values in deployment secrets; never expose either value in a
-# browser, MCP/n8n request, SDK result, audit record, or log.
 FLUX_SPACE_URL=
 FLUX_SPACE_TOKEN=
 GENERATION_WORKER_ENABLED=true
@@ -107,8 +90,6 @@ GENERATION_WORKER_INTERVAL_SECONDS=5
 GENERATION_WORKER_POLL_BACKOFF_SECONDS=2
 GENERATION_WORKER_BATCH_SIZE=8
 GENERATION_JOB_STALE_AFTER_SECONDS=900
-# Content Studio persistence/render limits. Editor state and render jobs are
-# durable PostgreSQL records; render workers use bounded temporary files only.
 EDITOR_STATE_MAX_BYTES=1048576
 RENDER_WORKER_ENABLED=true
 RENDER_WORKER_INTERVAL_SECONDS=2
@@ -122,61 +103,39 @@ RENDER_MAX_DURATION_SECONDS=3600
 RENDER_MAX_INPUT_BYTES=4294967296
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
-# YouTube Data API v3 worker controls. Keep the client secret backend-only.
-# Upload chunks must be a multiple of 262144 bytes (256 KiB).
 YOUTUBE_UPLOAD_CHUNK_BYTES=8388608
 YOUTUBE_MAX_CONCURRENT_UPLOADS=2
 YOUTUBE_REQUEST_TIMEOUT_SECONDS=60
 YOUTUBE_PROCESSING_POLL_SECONDS=30
 META_CLIENT_ID=
 META_CLIENT_SECRET=
-# Preferred Meta application names. META_CLIENT_* remains a compatibility
-# alias for deployments created before this configuration contract.
 META_APP_ID=
 META_APP_SECRET=
 META_GRAPH_API_VERSION=v25.0
 TIKTOK_CLIENT_KEY=
 TIKTOK_CLIENT_SECRET=
-# Exact backend callback registered under TikTok Login Kit. It must be:
-# https://<api-host>/v1/social/accounts/tiktok/callback
 TIKTOK_REDIRECT_URI=
-# Fail closed. Set true only after Content Posting API Direct Post approval and
-# video.publish authorization are confirmed for this TikTok application.
 TIKTOK_DIRECT_POST_ENABLED=false
-# TikTok FILE_UPLOAD chunks: 5,000,000 through 64,000,000 bytes.
 TIKTOK_UPLOAD_CHUNK_BYTES=10000000
 TIKTOK_REQUEST_TIMEOUT_SECONDS=60
 TIKTOK_PROCESSING_POLL_SECONDS=30
-# Test-only opt-in. Normal CI must keep this false; dedicated credentials and
-# explicit publish consent are documented in social-tiktok-production-readiness.md.
 RUN_TIKTOK_INTEGRATION_TESTS=false
 LINKEDIN_CLIENT_ID=
 LINKEDIN_CLIENT_SECRET=
-# Exact backend callback registered in the LinkedIn Developer Portal:
-# https://<api-host>/v1/social/accounts/linkedin/callback
 LINKEDIN_REDIRECT_URI=
-# Enable only after LinkedIn has approved the required Community Management
-# products/scopes for member and/or organization publishing.
 LINKEDIN_PUBLISHING_ENABLED=false
 LINKEDIN_REQUEST_TIMEOUT_SECONDS=60
 LINKEDIN_MEDIA_PROCESSING_POLL_SECONDS=5
 LINKEDIN_MEDIA_PROCESSING_TIMEOUT_SECONDS=600
-# Test-only opt-in. Normal CI must keep this false; dedicated credentials and
-# explicit publish/delete consent are documented in social-linkedin-production-readiness.md.
 RUN_LINKEDIN_INTEGRATION_TESTS=false
 X_CLIENT_ID=
 X_CLIENT_SECRET=
-# Exact backend callback registered in the X Developer Console:
-# https://<api-host>/v1/social/accounts/x/callback
 X_REDIRECT_URI=
-# Enable only after confirming current X write/media endpoint entitlement.
 X_PUBLISHING_ENABLED=false
 X_UPLOAD_CHUNK_BYTES=5242880
 X_REQUEST_TIMEOUT_SECONDS=60
 X_MEDIA_PROCESSING_POLL_SECONDS=5
 X_MEDIA_PROCESSING_TIMEOUT_SECONDS=300
-# Test-only opt-in. Normal CI must keep this false; dedicated credentials and
-# explicit publish/delete consent are documented in social-x-production-readiness.md.
 RUN_X_INTEGRATION_TESTS=false
 TELEGRAM_BOT_TOKEN=
 WHATSAPP_CLIENT_ID=