[dxfareed]

Closes #5

What changed: frontend/wallet/.env.example and the env table in frontend/wallet/README.md now cover all 28 environment variables the wallet reads, grouped by concern, with what each one is needed for. Plus a short "Run the wallet" pointer in the root README, which had no wallet section at all.

Why: I enumerated every process.env.* read under app/, lib/, components/ and hooks/. The wallet consumes 28 variables (excluding CI and NODE_ENV, which the runtime provides). .env.example documented 18 and the README table listed 9, so ten were discoverable only by grepping:

NEXT_PUBLIC_RPC_URL, SOROBAN_MAINNET_RPC_URL, NEXT_PUBLIC_RP_ID, NEXT_PUBLIC_ORIGIN, NEXT_PUBLIC_LENS_URL, NEXT_PUBLIC_SOROSWAP_API_KEY, NEXT_PUBLIC_BLEND_POOL_IDS, NEXT_PUBLIC_SEP24_ANCHORS, NEXT_PUBLIC_SENTRY_DSN, SPONSOR_SECRET_KEY.

On "required vs optional": strictly, none are required. Every variable either has a working default compiled into lib/, or gates a feature that degrades cleanly when unset, so a fresh clone runs on testnet with an untouched .env.example — I verified this by building against a straight copy of it. A bare required/optional flag would therefore have been misleading, so both files state that up front and the column says what a blank value actually costs you (mainnet, /agent, /earn, dApp connections, sponsored trustlines, creating a vault, /multisig on mainnet, native builds). Say the word if you would rather have a plain two-value flag.

Descriptions come from reading each call site, so they record the behaviour rather than restating the name — the NEXT_PUBLIC_SOROBAN_RPC_URL → NEXT_PUBLIC_RPC_URL precedence in lib/network.ts, the three-way mainnet RPC precedence and why the server-side one is preferred, Soroswap falling back to SDEX paths, and /multisig being gated off entirely on a network with no hash.

On secrets: SPONSOR_SECRET_KEY is a spendable Stellar secret key. It is documented with an empty placeholder, marked server-only, and flagged that it must never gain a NEXT_PUBLIC_ prefix. Every non-empty value in the file is a public contract address, a public Stellar endpoint, or localhost. I grepped the file for anything shaped like an S… secret key: none.

Existing comment prose is preserved verbatim wherever it already existed; the churn is grouping, markers and the new entries.

How tested:

• Cross-checked both directions by script: 28 consumed, 28 in .env.example, 28 in the README table, with no variable missing from either and none documented that is not actually read.
• .env.example parses: every non-comment line is a valid KEY=VALUE, no duplicate keys.
• Copied .env.example to .env.local verbatim and ran npm run build in frontend/wallet — succeeds, all routes compile. Removed the file afterwards.

Notes:

The full table lives in frontend/wallet/README.md, next to the code it describes and where an ## Environment variables section already existed. The root README gets a pointer rather than a second copy, since two tables of 28 rows would drift apart within a release.

One thing worth a look, not touched here: .github/workflows/ci.yml sets NEXT_PUBLIC_NETWORK_PASSPHRASE for the wallet build jobs, but nothing in the wallet reads it — the passphrase is hardcoded per network in lib/network.ts's NETWORKS. It looks like a leftover, and I left it alone rather than widen this PR into the workflow.