Vercel deployment hygiene: secrets, headers, and preview URLs

Most ADSA Labs frontends deploy to Vercel; backends may sit on Supabase, Laravel Forge, or AWS depending on the client. Misconfigured env vars are the silent bug: preview deployments accidentally pointing at production databases, or `NEXT_PUBLIC_` prefixes on keys that were never public.

We split environments strictly — production Supabase project IDs never appear in Preview unless a branch explicitly needs a staging clone. Resend, Stripe, and webhook secrets are production-only; previews use sandboxes or disabled outbound webhooks.

Security headers (CSP, frame ancestors, referrer policy) ship with the Next config for marketing and admin shells. They are not a substitute for auth, but they reduce clickjacking and casual script injection when someone drops a vulnerable third-party script tag.

After public breach news cycles, we rotate deploy tokens and audit GitHub → Vercel integrations. One compromised OAuth app can push malicious builds faster than phishing a CEO.