Document PocketBase env vars in .env.local.example

Adds the four variables the PocketBase integration will use:

  - NEXT_PUBLIC_POCKETBASE_URL    — client-safe PB URL (no
                                     NEXT_PUBLIC_ on the auth values!)
  - POCKETBASE_ADMIN_EMAIL         — server-only admin login
  - POCKETBASE_ADMIN_PASSWORD      — server-only admin password
  - POCKETBASE_ADMIN_TOKEN         — optional pre-issued token

The real .env.local stays out of git (.env.local is gitignored);
developers copy this file to .env.local and fill in their credentials.

.env.local.example

@@ -1,14 +1,27 @@
-# Simple PIN gate (the user enters this PIN on the login screen).
-# Change this value to whatever PIN you want on the construction site.
+# PIN gate — change this in production. Exposed to the client because the
+# lock screen validates it locally before talking to PocketBase.
 NEXT_PUBLIC_APP_PIN=2468
 
-# Optional: name shown on the lock screen and header.
-NEXT_PUBLIC_APP_NAME="MEGA INFRASTRUCTURE"
-
-# Optional: switch the default theme. Use "light" or "dark".
+# Brand
+NEXT_PUBLIC_APP_NAME=MEGA INFRASTRUCTURE
 NEXT_PUBLIC_DEFAULT_THEME=light
 
-# Optional: when you wire up PocketBase / a backend, point at it here.
+# Local API base URL (the Next.js app's own /api routes — currently a stub)
 NEXT_PUBLIC_API_BASE_URL=http://localhost:3000/api
-POCKETBASE_URL=
-POCKETBASE_TOKEN=
+
+# ── PocketBase ─────────────────────────────────────────────────────────────
+# Public client-side URL. Safe to expose because PocketBase handles
+# auth at the collection-rule level — public reads need a token, the
+# URL alone is not a credential.
+NEXT_PUBLIC_POCKETBASE_URL=https://your-pocketbase.example.com
+
+# Server-side only — used by Next.js server components / route handlers
+# to seed data, sync files and run admin operations. NEVER prefix with
+# NEXT_PUBLIC_ or the credentials leak into every browser bundle.
+POCKETBASE_ADMIN_EMAIL=admin@example.com
+POCKETBASE_ADMIN_PASSWORD=change-me
+
+# If you have an existing auth token you can paste it here instead of
+# having the server re-authenticate on every cold start. Leave blank
+# to let the server log in with the email + password above.
+POCKETBASE_ADMIN_TOKEN=