docs(env): document Mux vars in .env.example, fix stale R2 references in AvatarUpload

.env.example was missing MUX_TOKEN_ID/MUX_TOKEN_SECRET/MUX_WEBHOOK_SECRET/
NEXT_PUBLIC_APP_URL even though they're required fields per docker/.env.
AvatarUpload's docblock still described the pre-migration R2 upload path;
storage has been Supabase-only since the R2 removal.

Local .env/.env.local consolidation (not tracked by git) done alongside
this: merged the split DB/Supabase/Clerk/Mux config into .env.local and
removed the dead, never-filled R2 placeholder vars from .env.

.env.example

@@ -25,6 +25,16 @@ SUPABASE_SERVICE_ROLE_KEY="eyJxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY="pk_test_xxxxxxxxxxxxxxxxxxxx"
 CLERK_SECRET_KEY="sk_test_xxxxxxxxxxxxxxxxxxxx"
 
+# ── Mux (Video) ──────────────────────────────────────────────
+# Mux Dashboard → Settings → Access Tokens → Create Token (Mux Video)
+MUX_TOKEN_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+MUX_TOKEN_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+# Mux Dashboard → Webhooks → Add endpoint → copy Signing Secret
+# Endpoint must point at https://<your-domain>/api/webhooks/mux
+MUX_WEBHOOK_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+# Your public app URL (used as CORS origin for Mux direct uploads)
+NEXT_PUBLIC_APP_URL="http://localhost:3000"
+
 # ── Admin Panel ───────────────────────────────────────────────
 # NEVER use NEXT_PUBLIC_ prefix — these MUST stay server-only!
 # ADMIN_SECRET: random UUID path segment (/p/[secret]/) — generate with:

src/components/pet/AvatarUpload.tsx

@@ -18,14 +18,14 @@ import { uploadFileWithProgress } from "@/lib/upload-xhr";
  * Upload flow (Architecture constraint — image bytes never pass through Next.js API):
  * 1. File validated client-side (size <= 10MB, type jpeg/png/webp)
  * 2. media.getPresignedUrl tRPC mutation → { presignedUrl, key }
- * 3. XMLHttpRequest PUT directly to R2 presigned URL (tracks upload progress)
+ * 3. XMLHttpRequest PUT directly to the Supabase Storage presigned URL (tracks upload progress)
  * 4. media.confirmUpload tRPC mutation → writes avatarKey to Pet DB row
  * 5. CDN URL constructed and displayed; onUploadComplete callback fired
  *
  * Security:
- * - No R2 credentials in this client component (T-4-03)
+ * - No Supabase Storage credentials in this client component (T-4-03)
  * - contentType sent to presignedUrl MUST match Content-Type in PUT (Pitfall 4 prevention)
- * - NEXT_PUBLIC_R2_PUBLIC_URL is the CDN domain only — not credentials
+ * - NEXT_PUBLIC_SUPABASE_URL is the CDN domain only — not credentials
  *
  * Props:
  * - petId: string | undefined — undefined in create mode (upload disabled until pet saved)