Wire new routes and environment keys for the recent modules.

Register AdSense, artwork review, comment captcha, lazy collections, and upload review props, and document the matching env vars and CLI commands.

.env.example

@@ -4,6 +4,9 @@ APP_KEY=
 APP_DEBUG=true
 APP_URL=http://localhost
 
+# Maximum secondary artwork categories in addition to the primary category.
+CATEGORIES_MAX_SECONDARY=5
+
 # Artwork original downloads: PHP fallback unless nginx X-Accel is configured.
 # Leave false until the internal location exists and has been verified.
 DOWNLOAD_ACCEL_ENABLED=false
@@ -71,6 +74,26 @@ SKINBASE_SESSION_DEBUG_HEADER=false
 BROADCAST_CONNECTION=reverb
 FILESYSTEM_DISK=local
 QUEUE_CONNECTION=redis
+
+# Comment spam protection: observe records scores without changing visibility.
+COMMENT_SPAM_ENABLED=true
+COMMENT_SPAM_MODE=enforce
+COMMENT_SPAM_AI_ENABLED=true
+COMMENT_SPAM_AI_PROVIDER=together
+# Supported: Prism-ML/Ternary-Bonsai-27B or meta-llama/Llama-3.2-3B-Instruct-Turbo
+COMMENT_SPAM_AI_MODEL=meta-llama/Llama-3.2-3B-Instruct-Turbo
+COMMENT_SPAM_AI_TIMEOUT=5
+TOGETHER_API_KEY=
+TOGETHER_API_BASE_URL=https://api.together.xyz/v1
+COMMENT_SPAM_LOCAL_SAFE_MAX=29
+COMMENT_SPAM_LOCAL_SPAM_MIN=70
+COMMENT_SPAM_AI_SPAM_MIN=70
+COMMENT_SPAM_SIGNATURE_CACHE_MINUTES=1440
+COMMENT_TURNSTILE_ENABLED=false
+COMMENT_TURNSTILE_SITE_KEY=
+COMMENT_TURNSTILE_SECRET_KEY=
+COMMENT_TURNSTILE_RISK_THRESHOLD=40
+COMMENT_TURNSTILE_FAIL_OPEN=false
 # Must exceed Horizon supervisor-default timeout (960s). Production used 90s
 # and nightly RecComputeSimilar* jobs failed with MaxAttemptsExceeded.
 REDIS_QUEUE_RETRY_AFTER=1080
@@ -133,6 +156,13 @@ UPLOAD_CHUNK_REQUEST_TIMEOUT_MS=45000
 UPLOAD_RATE_CHUNK_USER=180
 UPLOAD_RATE_CHUNK_IP=360
 
+# New accounts without this many moderator/legacy published artworks go to review.
+# Queued uploads and trusted_auto publishes do not count, so a new user's 6th upload stays hidden.
+UPLOAD_MIN_APPROVED_UPLOADS=5
+UPLOAD_MIN_ACCOUNT_AGE_DAYS=7
+UPLOAD_MAX_UNTRUSTED_LEVEL=1
+UPLOAD_BOT_RISK_REVIEW_THRESHOLD=40
+
 # Draft abuse prevention controls
 SKINBASE_MAX_DRAFTS=10
 SKINBASE_MAX_DRAFT_STORAGE_MB=1024
@@ -445,6 +475,13 @@ GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 GOOGLE_REDIRECT_URI=/auth/google/callback
 
+# Google AdSense Management API (admin analytics, read-only)
+# Redirect URI must match the Google Cloud OAuth client exactly.
+ADSENSE_CLIENT_ID=
+ADSENSE_CLIENT_SECRET=
+ADSENSE_REDIRECT_URI=https://skinbase.org/admin/adsense/oauth/callback
+ADSENSE_SYNC_ENABLED=true
+
 # Optional light theme feature
 # Set LIGHT_THEME_ENABLED=true to allow a light theme in the client-side toggle.
 # Set LIGHT_THEME_SHOW_SWITCH=true to display the theme switch in the toolbar.