docs: document Space Secrets / env vars for operators

Document required env var names for operators. No secret values included.

README.md

@@ -43,3 +43,28 @@ npm run build
 ## Deployment
 
 This repository is configured as a **Docker Space** and serves the Next.js app on port `7860`.
+
+
+## Environment variables (Space Secrets)
+
+Set these in **Settings → Variables and secrets** on the Space. Do **not** commit values to git.
+
+| Name | Required | Purpose |
+|------|----------|---------|
+| `SESSION_SECRET` | Yes | Signs session cookies (`src/lib/session.ts`). Use a long random string; rotate if leaked. |
+| `HF_OAUTH_CLIENT_ID` | Yes* | Hugging Face OAuth app client id (`src/lib/huggingface.ts`). |
+| `HF_OAUTH_CLIENT_SECRET` | Yes* | OAuth app client secret — Space **Secret** only. |
+| `HF_DATASET_REPO` | Yes* | Target dataset repo for signup writes (e.g. `org/name`). |
+| `HF_DATASET_WRITE_TOKEN` | Yes* | Write-scoped Hub token for that dataset — Space **Secret** only; least privilege. |
+| `APP_URL` | Recommended | Public Space URL used for OAuth redirects (e.g. `https://humanitys-last-hackathon-signup.hf.space`). |
+| `HF_HUB_URL` | Optional | Hub base URL; defaults to `https://huggingface.co`. |
+| `NODE_ENV` | Set by Docker | `production` in the Space image. |
+
+\*Required when using the full HF OAuth + dataset write path. If the live page only deep-links to HF registration, some OAuth vars may be unused — verify against current `page.tsx` / API routes before rotating.
+
+### Operator checks
+
+1. Secrets exist in the Space UI (not in the repo).
+2. `SESSION_SECRET` is unique to this Space and not reused elsewhere.
+3. `HF_DATASET_WRITE_TOKEN` is scoped to the signup dataset only; rotate after staff changes.
+4. OAuth redirect URI in the HF OAuth app matches `APP_URL` + the callback route under `/api/auth/huggingface/callback`.