diff --git a/.env-development b/.env-development
index 31a60e9..8ad8bc8 100644
--- a/.env-development
+++ b/.env-development
@@ -1,10 +1,13 @@
 # ═══════════════════════════════════════════════════════════════════════════════
 #  $APP_NAME — Environment Variables Template (LOCAL DEVELOPMENT)
-#  Copy to .env and fill in the CHANGE_ME values before running `npm run dev`.
+#  Points at the team's shared dev infra (CockroachDB Cloud, Garage, Google
+#  OAuth, PayPal Sandbox, Gmail) — nothing to stand up locally. The only
+#  CHANGE_ME values left are the 4 per-machine secrets (JWT*/SESSION_SECRET,
+#  auto-generated by new_starr_setup's wizard) and the optional Chibisafe block.
 #
 #  Local development setup:
 #    1. cp .env-development .env
-#    2. Fill in every CHANGE_ME value below
+#    2. Fill in the remaining CHANGE_ME values below (or let the setup wizard do it)
 #    3. npm install
 #    4. npm run dev        (nodemon, auto-restarts on file change)
 #
@@ -21,17 +24,17 @@ NODE_ENV=development
 ORIGIN_GUARD_DISABLED=true   # allows Postman/curl in dev; hard-locked false when NODE_ENV=production
 PORT=3024
 APP_URL=http://localhost:3024
-APP_LOGO_URL=https://your-cdn.com/logo.png
+APP_LOGO_URL=https://cq5as7pc73.ufs.sh/f/pHNnzIw3VjcgjEJ1kFubDgYdvnt1cCAMyRjfOIGiUXPmZF3W
 FRONTEND_URL=http://localhost:5173
 
 # ── Database (PostgreSQL) ─────────────────────────────────────────────────────
-#  Local Postgres install — no SSL needed.
-DB_HOST=127.0.0.1
-DB_PORT=5432
-DB_NAME=CHANGE_ME
-DB_USER=CHANGE_ME
-DB_PASSWORD=CHANGE_ME
-DB_SSL=false
+#  Shared team CockroachDB Cloud cluster — SSL is on by default (see
+#  config/db.config.js: useSSL is true unless DB_SSL=false is set explicitly).
+DB_HOST=philproperties-16426.j77.aws-ap-southeast-1.cockroachlabs.cloud
+DB_PORT=26257
+DB_NAME=star-philpro
+DB_USER=lash
+DB_PASSWORD=K5mXTLyL_FrVGOHLHpzU4g
 DB_FORCE_SYNC=false   # never drop tables — even in dev, unless you mean it
 
 # ── Cache driver ──────────────────────────────────────────────────────────────
@@ -40,7 +43,10 @@ DB_FORCE_SYNC=false   # never drop tables — even in dev, unless you mean it
 CACHE_DRIVER=memory
 
 # ── JWT ───────────────────────────────────────────────────────────────────────
-#  Generate each secret independently — never reuse across fields.
+#  Per-machine secrets — never reuse across fields or share between devs.
+#  new_starr_setup's wizard auto-generates fresh values for these on first run;
+#  if filling this in by hand instead, generate each independently:
+#    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 JWT_SECRET=CHANGE_ME_32_BYTE_HEX
 MEDIA_JWT_SECRET=CHANGE_ME_32_BYTE_HEX
 JWT_EXPIRES_IN=15m
@@ -48,41 +54,38 @@ JWT_REFRESH_SECRET=CHANGE_ME_32_BYTE_HEX
 JWT_REFRESH_EXPIRES_IN=7d
 
 # ── CSRF & Cookies ────────────────────────────────────────────────────────────
+#  Also per-machine — auto-generated by the setup wizard, see note above.
 SESSION_SECRET=CHANGE_ME_32_BYTE_HEX
 
 # ── Google OAuth ──────────────────────────────────────────────────────────────
-#  console.cloud.google.com → Credentials → OAuth 2.0 Client ID
-#  Add http://localhost:3024/api/auth/google/callback to Authorized redirect URIs
-GOOGLE_CLIENT_ID=CHANGE_ME
-GOOGLE_CLIENT_SECRET=CHANGE_ME
+#  Shared team OAuth client (console.cloud.google.com → Credentials).
+GOOGLE_CLIENT_ID=379154949440-atchm4lurp9c1k23vbsjvgnqod2o9s5c.apps.googleusercontent.com
+GOOGLE_CLIENT_SECRET=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
 GOOGLE_CALLBACK_URL=http://localhost:3024/api/auth/google/callback
 
 # ── PayPal ────────────────────────────────────────────────────────────────────
-#  Use Sandbox credentials for local testing: developer.paypal.com → Sandbox tab.
-PAYPAL_CLIENT_ID=CHANGE_ME
-PAYPAL_CLIENT_SECRET=CHANGE_ME
+#  Shared team Sandbox app: developer.paypal.com → Sandbox tab.
+PAYPAL_CLIENT_ID=AYjb-DmhvvCagQM0SZxw-sfz30Qb8D-dBPr-wmvq80zOKmfxUrKykv-h85Kzp_Z5YmCX4T06DlaH2-zK
+PAYPAL_CLIENT_SECRET=EDkmLa47T0H5QtKdO8VfKdEDh--tuzP0Q2c_RFKASvdIJvs2j051v7j2hW0f8JxNDpjW8XyixE4JCxV4
 PAYPAL_ENV=sandbox
 
 # ── Email (Gmail API — OAuth2, over HTTPS) ────────────────────────────────────
-#  Reuses the same OAuth client as GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET above —
-#  enable the Gmail API on that project, then run:
-#    node scripts/get_gmail_refresh_token.js
-#  and paste the printed value below.
-GMAIL_REFRESH_TOKEN=CHANGE_ME
-EMAIL_FROM=CHANGE_ME@gmail.com
+#  Reuses the same OAuth client as GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET above.
+#  Shared team refresh token — same value the deployed app uses.
+GMAIL_REFRESH_TOKEN=1//0ebfPPkFoe9piCgYIARAAGA4SNwF-L9IrsTIWK1dWFRa2dmc33jd94_u5IA-LpTKQweSi3NODT78UhX91OH25ewE_riCT-DjaQg8
+EMAIL_FROM=services.philpro@gmail.com
 
 OTP_EXPIRY_MINUTES=10
 
-# ── S3-compatible Storage (Garage, run locally — bare-metal) ─────────────────
-#  Run Garage directly on your machine (the docker-compose.yml Garage service
-#  is set up for the production stack). See:
-#  https://garagehq.deuxfleurs.fr/documentation/quick-start/
-S3_ENDPOINT=http://127.0.0.1:3900
+# ── S3-compatible Storage (Garage) ────────────────────────────────────────────
+#  Shared team Garage instance. Uses the public HTTPS endpoint here (not a
+#  loopback/WireGuard address) so it works on a fresh machine with no tunnel.
+S3_ENDPOINT=https://media.star-philpro-media.space
 S3_REGION=garage
-S3_ACCESS_KEY=CHANGE_ME
-S3_SECRET_KEY=CHANGE_ME
-S3_BUCKET=CHANGE_ME
-S3_PUBLIC_URL=http://127.0.0.1:3900
+S3_ACCESS_KEY=GK1c811a656fafd5ae444eea7b747c4869
+S3_SECRET_KEY=76001b32d753375bd1fc22c9389b590021143b6fbe9d1688d8ed4dba5f004965
+S3_BUCKET=philproperties
+S3_PUBLIC_URL=https://media.star-philpro-media.space
 
 # ── Chibisafe (optional — used alongside S3 for some asset types) ────────────
 CHIBISAFE_BASE_URL=CHANGE_ME