sync: port upstream plan fold and per-device provider settings (#5558–#5580)

.env.example

@@ -1,12 +1,14 @@
 # Optional: T3 Connect source builds
-# Leave these unset to disable optional T3 Connect features in local source builds.
-# Release builds inject their public values at build time. Do not add server-side
-# secrets to this file.
+# `cp .env.example .env` enables T3 Connect against the production deployment.
+# These are the same public identifiers baked into official release builds, not
+# secrets. Remove or comment them out to build with cloud features disabled.
+# Do not add server-side secrets to this file.
 
-# Get these from the Clerk Dashboard under API keys, JWT templates, and OAuth applications.
-# T3CODE_CLERK_PUBLISHABLE_KEY=pk_test_...
-# T3CODE_CLERK_JWT_TEMPLATE=t3-relay
-# T3CODE_CLERK_CLI_OAUTH_CLIENT_ID=oauthapp_...
+# Production Clerk instance. To use your own, get these from the Clerk Dashboard
+# under API keys, JWT templates, and OAuth applications.
+T3CODE_CLERK_PUBLISHABLE_KEY=pk_live_Y2xlcmsudDMuY29kZXMk
+T3CODE_CLERK_JWT_TEMPLATE=t3-relay
+T3CODE_CLERK_CLI_OAUTH_CLIENT_ID=hzxSgY2cH10sDU2r
 
 # Optional: signed macOS passkey builds. The RP domain defaults to the Frontend API
 # hostname encoded in T3CODE_CLERK_PUBLISHABLE_KEY. Set the override only when Clerk
@@ -15,8 +17,9 @@
 # T3CODE_MACOS_PROVISIONING_PROFILE=/absolute/path/to/t3code.provisionprofile
 # T3CODE_CLERK_PASSKEY_RP_DOMAINS=example.clerk.accounts.dev,clerk.example.com
 
-# Get this from your relay deployment. `infra/relay` deploys update it automatically.
-# T3CODE_RELAY_URL=https://relay.example.com
+# Production relay. For a self-hosted relay, `infra/relay` deploys update it
+# automatically.
+T3CODE_RELAY_URL=https://relay.t3.codes
 
 # Optional: hosted app origin used by the CLI's out-of-band OAuth flow.
 # Defaults to https://app.t3.codes; override to test against a staging deployment.