add game config configuration

.env.example

@@ -23,3 +23,36 @@ RECFLARE_DOMAIN=rec.example.com
 # Kept out of the committed wrangler.jsonc (which uses a "local" placeholder) and
 # spliced in at deploy time. Required to deploy any worker.
 # RECFLARE_SECRETS_STORE=00000000-0000-0000-0000-000000000000
+
+# --- Server tuning (all optional; the shown value is the built-in default) ---
+# Everything below is passed to the workers as a variable, named without the RECFLARE_
+# prefix: RECFLARE_STARTING_TOKENS becomes STARTING_TOKENS. Every worker gets every knob —
+# the ones that don't read a knob just ignore it — so nothing here has to be routed to a
+# particular service, and two services reading the same knob agree on it for free. (The five
+# settings above are the exception: they configure the deploy itself, not the workers.)
+#
+# The same values are used by `just deploy` and by `just dev`, so a knob is set in exactly
+# one place. Change one and re-deploy the worker that reads it (e.g. `just deploy -F auth`)
+# for it to take effect. Leave a line commented out and the worker uses its built-in
+# default — and deleting a line you'd set really does restore that default on the next
+# deploy.
+#
+# Don't set these in the Cloudflare dashboard — a deploy replaces a worker's variables
+# wholesale, so a dashboard-set value is wiped by your next `just deploy`. This file is the
+# durable place. (Actual secrets don't go here either: they live in the Cloudflare Secrets
+# Store, like the shared JWT signing key above.)
+
+# How many accounts one signup source may create (`auth`). Enforced on signup only,
+# never on login: an existing account always stays reachable. Set either to 0 to turn
+# that cap off entirely.
+#   ...PER_PLATFORM_ID counts accounts per Steam-verified identity — unspoofable.
+#   ...PER_IP counts accounts per signup IP — coarse, since a household, NAT or campus
+#   network shares one address. This is the one to raise (or zero out) if real players
+#   report being locked out.
+# RECFLARE_MAX_ACCOUNTS_PER_PLATFORM_ID=3
+# RECFLARE_MAX_ACCOUNTS_PER_IP=3
+
+# RecCenterTokens a new player is granted, the first time their balance is read (`econ`).
+# 0 means players start broke. Applies only to players who haven't been granted yet —
+# raising it later does NOT top up existing players.
+# RECFLARE_STARTING_TOKENS=10000