build: add per-environment (test/prod) Makefile targets

Split env config into local vs remote:
- .env: local/shared config, always loaded (docker compose + make test)
- .env.test / .env.prod: full remote config, loaded on demand via ENV

Remote targets now generate -test/-prod variants (e.g. remote-install-prod);
a guard-env prerequisite blocks bare remote targets with no environment set.
Refresh .env.example to document the two-tier layout and add .env.prod/.env.test
to gitignore and the never-read list in CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,13 @@
+# Local/shared config — always loaded. Keep remote credentials OUT of here;
+# those live in .env.test / .env.prod. (docker compose also reads .env directly
+# for ${UID}/${GID} substitution and the travel-memories env_file.)
 -include .env
+
+# Remote config — loaded only when targeting an environment. ENV is set
+# automatically by the env-suffixed remote targets (e.g. `make remote-install-prod`);
+# each .env.<ENV> holds a full, self-contained set of remote vars.
+ENV ?=
+-include .env.$(ENV)
 export
 
 REMOTE_PORT ?= 22
@@ -6,6 +15,24 @@ SSH := ssh -p $(REMOTE_PORT) $(REMOTE_USER)@$(REMOTE_HOST)
 WEBROOT ?= $(REMOTE_HOME)/public_html
 SITE_CONFIG_DIR ?= $(REMOTE_HOME)/site-config
 
+# ── Environment guard + generated per-env remote targets ──────────────────────
+# Every remote-* target below gains `-test` / `-prod` variants, e.g.
+#   make remote-install-prod   →   runs remote-install with ENV=prod
+# Calling a bare remote target (no ENV) fails via guard-env.
+REMOTE_TARGETS := remote-env-setup remote-env-remove remote-wipe remote-install \
+	remote-fetch remote-fetch-content remote-install-plugins remote-upgrade-grav \
+	remote-clean remote-maintenance-on remote-maintenance-off
+ENVS := test prod
+
+guard-env:
+	@test -n "$(ENV)"      || { echo "ERROR: no environment. Use an env-suffixed target, e.g. 'make remote-install-prod'."; exit 1; }
+	@test -f ".env.$(ENV)" || { echo "ERROR: missing .env.$(ENV)"; exit 1; }
+
+define make-env-target
+$(1)-$(2): ; @$$(MAKE) --no-print-directory $(1) ENV=$(2)
+endef
+$(foreach t,$(REMOTE_TARGETS),$(foreach e,$(ENVS),$(eval $(call make-env-target,$(t),$(e)))))
+
 # ── Tests ─────────────────────────────────────────────────────────────────────
 
 test-config:
@@ -80,21 +107,21 @@ content-pull:
 
 # ── Remote credentials ─────────────────────────────────────────────────────────
 
-remote-env-setup:
+remote-env-setup: guard-env
 	@$(SSH) "printf 'GITEA_HOST=%s\nGITEA_USER=%s\nGITEA_TOKEN=%s\n' \
 		'$(GITEA_HOST)' '$(GITEA_USER)' '$(GITEA_TOKEN)' > ~/.env-intotheeast && chmod 600 ~/.env-intotheeast"
 	@echo "Credentials written to server. Run 'make remote-env-remove' when done."
 
-remote-env-remove:
+remote-env-remove: guard-env
 	@$(SSH) "rm -f ~/.env-intotheeast"
 	@echo "Credentials removed from server."
 
 # ── Remote: initial install ────────────────────────────────────────────────────
 
-remote-wipe:
+remote-wipe: guard-env
 	$(SSH) "cd $(WEBROOT) && rm -rf assets backup bin cache images logs system tmp vendor webserver-configs index.php .htaccess CHANGELOG.md LICENSE.txt README.md"
 
-remote-install:
+remote-install: guard-env
 	$(SSH) "WEBROOT=$(WEBROOT) \
 		SITE_CONFIG_DIR=$(SITE_CONFIG_DIR) \
 		USER_REPO=$(USER_REPO) \
@@ -108,24 +135,24 @@ remote-install:
 
 # ── Remote: ongoing maintenance ────────────────────────────────────────────────
 
-remote-fetch:
+remote-fetch: guard-env
 	$(SSH) "git -C $(SITE_CONFIG_DIR) checkout main && git -C $(SITE_CONFIG_DIR) pull"
 
-remote-fetch-content:
+remote-fetch-content: guard-env
 	$(SSH) "git -C $(WEBROOT)/user fetch origin main && git -C $(WEBROOT)/user sparse-checkout disable && git -C $(WEBROOT)/user reset --hard origin/main"
 
-remote-install-plugins:
+remote-install-plugins: guard-env
 	$(SSH) "cd $(WEBROOT) && php bin/gpm install $(shell cat plugins.txt | tr '\n' ' ') -y"
 
 
-remote-upgrade-grav:
+remote-upgrade-grav: guard-env
 	$(SSH) "cd $(WEBROOT) && php bin/grav upgrade"
 
-remote-clean:
+remote-clean: guard-env
 	$(SSH) "cd $(WEBROOT) && php bin/grav clearcache"
 
-remote-maintenance-on:
+remote-maintenance-on: guard-env
 	$(SSH) "bash -s on $(WEBROOT)" < scripts/server-maintenance.sh
 
-remote-maintenance-off:
+remote-maintenance-off: guard-env
 	$(SSH) "bash -s off $(WEBROOT)" < scripts/server-maintenance.sh