feat(config): phase 7 — drop /ims basePath, update all hardcoded paths, refresh env spec

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.local.example

@@ -1,14 +1,23 @@
-# .env.local.example
-NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
-NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key-here
-NEXT_PUBLIC_APP_URL=http://localhost:3000
+# Database (plain PostgreSQL — no Supabase)
+DATABASE_URL=postgres://app_user:<password>@127.0.0.1:5432/ims
+DATABASE_URL_ADMIN=postgres://app_admin:<password>@127.0.0.1:5432/ims
+
+# Auth (custom JWT)
+JWT_SECRET=<generate with: openssl rand -hex 32>
+
+# App
+APP_URL=http://localhost:3000
 NEXT_PUBLIC_SITE_URL=http://localhost:3000
 CRON_SECRET=<generate with: openssl rand -hex 32>
 
-# Server-side only — never expose to the client
-SUPABASE_SERVICE_ROLE_KEY=<required for admin user invites (/admin)>
-RESEND_API_KEY=re_...
-RESEND_FROM_EMAIL=alerts@yourdomain.com
+# Evidence storage (local filesystem)
+EVIDENCE_DIR=/tmp/ims-evidence
+EVIDENCE_URL_SECRET=<generate with: openssl rand -hex 32>
+
+# Email (Brevo)
+BREVO_API_KEY=<your-brevo-api-key>
+BREVO_FROM_EMAIL=noreply@setia.com.my
+BREVO_FROM_NAME=Setia IMS
 
 # AI keys — optional here; preferred location is the app_settings table (/hse/settings)
 ANTHROPIC_API_KEY=sk-ant-...