feat(mim): admin QR/brand API, public config hooks, and deploy workflow fix.

Split mim-api into modular routes, refresh nav brand assets, and pin reusable validate workflow to Order-of-Hospitallers/miracles_in_motion@main.

Co-authored-by: Cursor <[email protected]>

mim-api/.env.example

@@ -4,7 +4,16 @@ NODE_ENV=production
 MIM_PUBLIC_URL=https://mim4u.org
 MIM_DATA_DIR=/var/lib/mim-api/data
 
-# Stripe (required for live donations)
+# Portal auth (JWT signing — required in production)
+MIM_AUTH_SECRET=change-me-to-a-long-random-string
+
+# Portal users (seeded on first start if users.json missing)
+MIM_ADMIN_PASSWORD=
+MIM_VOLUNTEER_PASSWORD=
+MIM_RESOURCE_PASSWORD=
+
+# Stripe (can also be set via admin UI → persisted to admin-settings.json)
+STRIPE_PUBLISHABLE_KEY=
 STRIPE_SECRET_KEY=sk_live_...
 STRIPE_WEBHOOK_SECRET=whsec_...
 
@@ -15,5 +24,23 @@ SMTP_USER=
 SMTP_PASS=
 MIM_NOTIFY_EMAIL=[email protected]
 
+# Brand files (optional — default: $MIM_DATA_DIR/brand; set to /var/www/html/brand on 7810 for direct nginx serve)
+# MIM_BRAND_DIR=/var/lib/mim-api/data/brand
+
 # CORS (comma-separated origins; default mim4u.org)
 MIM_CORS_ORIGINS=https://mim4u.org,https://www.mim4u.org
+
+# QR codes — provider: qrcode-monkey (default) or qrcg (dynamic tracking)
+# QR Code Monkey docs: https://www.qrcode-monkey.com/qr-code-api-with-logo/
+# Direct API works without a key; optional RapidAPI after subscribing to
+# "Custom QR Code with Logo" on rapidapi.com:
+# RAPIDAPI_KEY=
+# QR_MONKEY_USE_RAPIDAPI=1
+# QR_MONKEY_LOGO_URL=https://mim4u.org/brand/logo-square.png
+# QR_MONKEY_SIZE=600
+
+# QRCG by Bitly — optional dynamic QR with scan analytics
+# Docs: https://dev.qrcg.com/
+# MIM_QR_PROVIDER=qrcg
+QRCG_API_KEY=
+# QRCG_LOGO_ID=