Read CI env from Infisical and give the local stack its own ports

CI reads Infisical staging as the read-only convexmonorepo-base-ci machine identity, runs the quality gate, and builds and pushes the image. The template is not deployed, so there is no Convex or VPS deploy step. The local stack moves to its own Compose name and ports so it runs beside the Payload template's, and it syncs the Convex runtime env. The scripts pick up Infisical account switching, dev-kill and a cache-safe CI install.

AGENTS.md

@@ -7,7 +7,7 @@
 - `packages/backend/convex`: self-hosted Convex functions, schema, and auth.
 - `packages/ui`: shared shadcn-based UI components.
 - `tools`: shared ESLint, Prettier, Tailwind, TypeScript, and Vitest config.
-- Local development uses host-run apps, local Convex on ports 3210/3211, and
+- Local development uses host-run apps, local Convex on ports 3250/3251, and
   its own data volume. Convex does not use Postgres unless a cloned project
   explicitly enables the commented optional `POSTGRES_URL` example.
 
@@ -27,8 +27,18 @@
 - Run `infisical login` and `infisical init` before local development.
 - Machine-generated values belong in `.local/<env>.generated.env`; never put
   the generated Convex admin key in shared Infisical.
-- CI uses Gitea-injected secrets or `CI_ENV_FILE` and must not call Infisical.
-- App code imports validated variables from `@/env`, never `process.env`.
+- CI reads `staging` through `scripts/ci-export-env.mjs`, logged in as the
+  read-only `convexmonorepo-base-ci` machine identity (Gitea secrets
+  `INFISICAL_CLIENT_ID` and `INFISICAL_CLIENT_SECRET`). `scripts/export-env`
+  refuses to run in CI.
+- This template's `staging` has no Convex admin key, so nothing here can deploy
+  to a real backend. A cloned app gets its own Infisical project.
+- If you are logged in to more than one Infisical account, put
+  `INFISICAL_EMAIL=...` in `scripts/flags/infisical.env` (gitignored) and the
+  scripts switch the CLI to that account before exporting.
+- Server code imports validated variables from `@/env`. Client components and
+  `instrumentation-client.ts` import from `@/publicEnv`, which keeps zod out of
+  the browser bundle. Never read `process.env` elsewhere.
 - Add cache-relevant variables to `turbo.json` `globalEnv`.
 
 ## Code and dependency rules
@@ -50,13 +60,28 @@ bun db:up          # start Convex and dashboard
 bun dev:next       # host Next + deploy/watch local Convex functions
 bun db:down        # stop and preserve Convex data
 bun db:down:wipe   # remove Convex volume and generated admin key
+bun db:sync-env    # re-push Infisical dev values into the local Convex env
+bun dev:kill       # stop dev servers that survived a Ctrl-C
 ```
 
-Local URLs: app `http://localhost:3000`, Convex `http://localhost:3210`,
-dashboard `http://localhost:6791`.
+Local URLs: app `http://localhost:3000`, Convex `http://localhost:3250`,
+dashboard `http://localhost:6795`. The Compose project and containers are named
+`convexmonorepo-base-local*` so this stack can run beside the Payload template's.
 Use `INFISICAL_ENV=staging bun dev:next` for staging services. Normal `db:up`
 never connects to staging and does not start Postgres.
 
+## Analytics and bundle size
+
+- Plausible (`NEXT_PUBLIC_PLAUSIBLE_SRC`, the per-site script URL) loads through
+  a same-origin proxy under `/pa`. PostHog (`NEXT_PUBLIC_POSTHOG_KEY`,
+  `NEXT_PUBLIC_POSTHOG_HOST`) loads after the page is idle through `/ingest`.
+  Both stay off when their env is unset.
+- Session replay comes from PostHog. Sentry carries errors and traces only.
+- `packages/ui/src/index.tsx` holds re-exports only (`cn` and `ccn` live in
+  `utils.ts`). With `optimizePackageImports` in `next.config.js`, each page
+  loads only the UI modules it imports. Declaring anything in the index breaks
+  that.
+
 ## Validation
 
 Use `bun typecheck`, never a production build for routine validation. The full