`CHANGES.md`

12 lines
## Applied
- .gitignore - canonical .gitignore added (node_modules, .env*, tmp/, *.log, .DS_Store, dist/, build/, .next/).
- .env - untracked from git (still present on disk, just not committed).
- .env.example:3 - added `DPLA_API_KEY` placeholder so the example template matches `.env`.

## Deferred (needs Steve)
- P0 - .env:2-5 - live Google Maps, Google Geocoding, and DPLA API keys are stored in plaintext - deferred because rotating real secrets and moving them to a secret store requires Steve; `.env` was left untouched.
- P0 - .env:3 - `GOOGLE_GEOCODING_API_KEY` may be billable if not strictly restricted - deferred because verifying GCP restrictions and rotating the key requires Steve.
- P0 - README.md:7-9 - repo claims signup, OAuth, claims, uploads, inventory, insurance export, shared backend, DB, and MCP, but no implementation exists here to review - deferred because the shared backend location and production architecture need Steve.
- P1 - README.md:5 - master plan lives outside this repo - deferred because copying architecture/runbook details is documentation work outside the approved safe-fix list.
- P1 - Project root - no package manifest, tests, routes, DB migrations, or deploy config exist - deferred because creating application structure is not a small surgical safe fix.