turso migration

.env.example

@@ -37,6 +37,27 @@ RECFLARE_DOMAIN=rec.example.com
 # spliced in at deploy time. Required to deploy any worker.
 # RECFLARE_SECRETS_STORE=00000000-0000-0000-0000-000000000000
 
+# OPTIONAL: run the workers on a libSQL server (Turso) INSTEAD of the D1 database above. Both
+# are SQLite; the schema, the migrations and the workers are the same, and the D1 database
+# stays bound (and RECFLARE_D1 still required) so switching back is unsetting this line and
+# redeploying. Leave both unset to use D1, which is the default.
+#
+# The URL is the one Turso shows for the database (`turso db show <name> --url`), as-is:
+#
+#   RECFLARE_LIBSQL_DB_URL=libsql://<database>-<org>.turso.io
+#
+# The token (`turso db tokens create <name>`) is the one entry in this file that IS a secret.
+# It is never passed as a var: `just deploy` puts it as an encrypted worker secret, and
+# `just migrate` / `runx admin --remote` read it from here to reach the database directly.
+#
+#   RECFLARE_LIBSQL_DB_AUTH_TOKEN=eyJ...
+#
+# `just dev` and the tests ignore both and stay on the local D1. Setting the URL changes what
+# `just migrate` and every `--remote` operator command talk to — the libSQL database, not D1 —
+# so it is one switch for the whole deployment: the workers, their migrations and the tooling
+# all move together, which is the only sane state for fifteen workers sharing one database.
+# To carry existing data over, see "Using Turso instead of D1" in DEPLOYING.md.
+
 # --- Server tuning (all optional; the shown value is the built-in default) ---
 # Everything below is passed to the workers as a variable, named without the RECFLARE_
 # prefix: RECFLARE_STARTING_TOKENS becomes STARTING_TOKENS. Every worker gets every knob —