chore: prod env checker, secret guidance, internet-exposure runbook

CHANGELOG.md

@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 ### Security
+- Production ops: `scripts/check_prod.py` validates `.env` secrets and
+  modes before deploy (with tests); README production checklist
+  (proxy gates for Langflow, secret rotation, upgrade runbook).
+### Security
 - API authorization: flow management is admin-only, runs and run/approval
   reads require login with strict session-tenant scoping, approval
   decisions record the session user, and flow callbacks authenticate with