- app/build.gradle.kts: remove hardcoded keystore password (was 'adacam-varroa-2026'
in 4 spots across a duplicated signingConfigs block). Now reads VARROA_KEYSTORE_PATH
+ VARROA_KEYSTORE_PASSWORD + VARROA_KEY_PASSWORD from env. Password vaulted as
'Varroa — release keystore'. Drops orphan zxing/camera deps that aren't wired up.
- app/src/main/res/xml/network_security_config.xml: tighten cleartext scope from
global to just 192.168.0.10 (Bee AP). HTTPS strict for everything else.
- app/src/main/java/.../api/AdaMapsApiClient.kt: drop apiKey.take(8) in log to
apiKey.length — no need to leak prefix to logcat.
- README.md: add. Public repo without one was a bad first impression.
- docs/BEE-CAMERA.md: rewrite (811→467 lines). Keep all paths, pinouts, bus
diagrams, depthai/VPU/xlink details, intercept architecture. Strip
Executive-Summary framing, verdict box, phased roadmap, appendices.
- docs/AIR-QUALITY-INTEGRATION.md: rewrite (712→369 lines). Keep BOM, sensor
comparisons, wiring, IAQ calc, ingest endpoint shape. Strip feasibility-report
scaffolding.
- docs/AIR-API-PATCH.py: delete. Was a one-shot apply-and-discard patch script,
not docs.
