diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..2119ebe
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,15 @@
+.git
+.env
+.env.*
+!.env.example
+!.env.production.example
+bin
+dist
+coverage
+.codex-runtime
+.tmp-*
+data/incoming/*
+*.log
+*.test
+*.out
+*.exe
diff --git a/.env.production.example b/.env.production.example
new file mode 100644
index 0000000..77285a3
--- /dev/null
+++ b/.env.production.example
@@ -0,0 +1,33 @@
+# Copy to .env when this repository is nested at deployment/backend.
+# DATABASE_URL, REDIS_ADDR, and REDIS_PASSWORD are injected by compose.yaml.
+APP_ENV=production
+HTTP_ADDR=0.0.0.0:8080
+IMPORT_PATH=/import/challenge_data.csv.gz
+
+DEMO_USERNAME=merchant-0001
+DEMO_PASSWORD=change-me-with-at-least-12-random-characters
+SESSION_SECRET=change-me-with-at-least-32-random-characters
+CURSOR_SECRET=change-me-with-a-different-32-character-secret
+FRONTEND_ORIGIN=https://zarinpal.amiirkhl.ir
+COOKIE_SECURE=true
+
+# Keep AI switches off until the selected provider key and positive budgets are set.
+AI_GROWTH_ENABLED=false
+AI_COACH_ENABLED=false
+AI_PAGE_INSIGHTS_ENABLED=false
+AI_PROVIDER=avalai
+AVALAI_API_KEY=
+AVALAI_BASE_URL=https://api.avalai.ir
+AVALAI_MODEL=gpt-5-mini-2025-08-07
+AGENTROUTER_API_KEY=
+AGENTROUTER_BASE_URL=https://agentrouter.org/v1
+AGENTROUTER_MODEL=gpt-5.6-sol
+AI_DAILY_REQUEST_BUDGET=0
+AI_DAILY_TOKEN_BUDGET=0
+AI_COACH_DAILY_REQUEST_BUDGET=0
+AI_COACH_DAILY_TOKEN_BUDGET=0
+AI_PAGE_INSIGHTS_DAILY_REQUEST_BUDGET=0
+AI_PAGE_INSIGHTS_DAILY_TOKEN_BUDGET=0
+AI_MAX_CONCURRENT=4
+AI_CREATE_PER_MINUTE=10
+AI_UNCACHED_SCOPES_PER_DAY=5
diff --git a/.gitignore b/.gitignore
index 4280e21..01b01d4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@
 .env
 .env.*
 !.env.example
+!.env.production.example
 
 # Go outputs and local tooling
 /bin/