consolidate runtime env into .env, drop ecosystem env blocks (#1229)

- Make .env the single source of truth for runtime config. Remove all
  `env:` blocks from SREBOT/ecosystem.config.js and TSSBOT/ecosystem.config.js
  so values can't silently shadow .env. Both ecosystem files load .env via
  `require('dotenv').config()` and PM2 inherits the resolved environment.

- Rename SREBOT_STORAGE_VOL_PATH → STORAGE_VOL_PATH across all readers
  (BOT/utils.py, BOT/receiver_bridge.py, BOT/render_recap.py, server.js,
  web/server.js, dateindex.js, scripts/*, srebot.service, tests/, README,
  and both .env files). STORAGE is shared between SREBOT and TSSBOT, so the
  variable shouldn't carry one bot's prefix.

- Rename per-process PORT env vars to disambiguated names so .env can be
  the source of truth without collisions:
    PORT (api)     → SREBOT_API_PORT     (server.js)
    PORT (web)     → SREBOT_WEB_PORT     (web/server.js)
    WEBHOOK_PORT   → SREBOT_WEBHOOK_PORT (github_webhook_updater.py)
  SREBOT_EXTERNAL_HOST/PORT/UPSTREAM_URL were already uniquely named;
  they just move from ecosystem env to .env.

- TSSBOT/.env: drop GITHUB_WEBHOOK_SECRET (only srebot-webhook consumes it)
  and the stale SREBOT_DEPLOY_PATH. SREBOT/.env: also drop the obsolete
  SREBOT_DEPLOY_PATH (ecosystem now hardcodes __dirname).

- ecosystem.config.js no longer references SREBOT_DEPLOY_PATH; deploy path
  is always __dirname of the ecosystem file.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ecosystem.config.js

@@ -1,18 +1,19 @@
+// Single source of truth for runtime config is TSSBOT/.env (loaded here).
+// Do NOT add `env:` blocks to apps below — they would override the .env values
+// and create two parallel config sources to reason about.
 require('dotenv').config();
 
-// __dirname resolves to BOTS/TSSBOT on disk. Override with TSSBOT_DEPLOY_PATH if
+const DEPLOY_PATH = __dirname;
-// you need to point at a different checkout (e.g. local dev).
-const DEPLOY_PATH = process.env.TSSBOT_DEPLOY_PATH || __dirname;
 
 // Reuse SREBOT's venv by default — both bots share BOTS/SHARED and most
-// runtime deps (discord.py, dotenv, etc.). Split into TSSBOT/.venv once
+// runtime deps (discord.py, dotenv, …). Split into TSSBOT/.venv once the
-// the dep sets diverge meaningfully.
+// dep sets diverge meaningfully.
 const PY_INTERPRETER =
   process.env.TSSBOT_PY_INTERPRETER || `${DEPLOY_PATH}/../SREBOT/.venv/bin/python`;
 
 module.exports = {
   apps: [
-    // Discord Bot (skeleton — currently just idles, see TSSBOT/start_bot.py)
+    // Discord Bot
     {
       name: 'tssbot',
       script: 'start_bot.py',
@@ -22,10 +23,6 @@ module.exports = {
       autorestart: true,
       watch: false,
       max_memory_restart: '8000M',
-      env: {
-        NODE_ENV: 'production',
-        PYTHONUNBUFFERED: '1'
-      },
       log_file: './logs/bot_combined.log',
       out_file: './logs/bot_out.log',
       error_file: './logs/bot_error.log',
@@ -34,7 +31,8 @@ module.exports = {
       kill_timeout: 5000,
       restart_delay: 3000
     }
-    // tssbot-api and tssbot-web will be added here once the API server and
+    // tssbot-api and tssbot-web will be added here once TSSBOT/server.js and
-    // web frontend exist under TSSBOT/server.js and TSSBOT/web/server.js.
+    // TSSBOT/web/server.js exist. They should read TSSBOT_API_PORT and
+    // TSSBOT_WEB_PORT from .env (mirroring the SREBOT naming convention).
   ]
 };