feat(federation): add RustyWeb commons sync

Author: Travis-Gilbert

.env.example

@@ -16,12 +16,14 @@
 
 # Comma-separated list of <secret>=<scope>|<scope>|... entries.
 # Generate the secret with: openssl rand -hex 32
-# Scopes: graph:read, graph:write, context:read, admin:read, *
+# Scopes: graph:read, graph:write, context:read, admin:read,
+# federation:write, *
 # REQUIRED when RUSTY_RED_REQUIRE_AUTH=true (the default).
 RUSTY_RED_API_TOKENS=
 
-# Refuse unauthenticated requests on /v1/* and /mcp. Keep true on any
-# endpoint reachable from outside a trusted network.
+# Refuse unauthenticated requests on search, crawl, federation, /v1/*,
+# /mcp, and metrics. Keep true on any endpoint reachable from outside a
+# trusted network.
 RUSTY_RED_REQUIRE_AUTH=true
 
 # Path to the persistent volume mount. Must match the volume's mount
@@ -50,6 +52,34 @@ RUSTY_RED_HOST=[::]
 # Public base URL; appears in the OpenAPI servers block.
 # RUSTY_RED_PUBLIC_URL=
 
+# ============================================================
+# RustyWeb Web Commons federation
+# ============================================================
+
+# Enabled by default. Default crawls are federable unless request scope
+# opts out; outbound submission happens only when hub URL + private key
+# are set.
+RUSTY_RED_FEDERATE=true
+
+# Hub base URL or full /federate/submit URL.
+# RUSTY_RED_FEDERATE_HUB_URL=
+
+# Bearer token for the hub. Token needs federation:write on the hub.
+# RUSTY_RED_FEDERATE_TOKEN=
+
+# 32-byte Ed25519 private key as hex. Required to submit signed fragments.
+# RUSTY_RED_FEDERATE_PRIVATE_KEY=
+
+# Optional Ed25519 public key hex. If set, it must match the private key.
+# RUSTY_RED_FEDERATE_PEER_ID=
+
+# Include seeds, budget, and actor id in submitted fragments. Off by
+# default so content+links can federate without seed-selection provenance.
+RUSTY_RED_FEDERATE_PROVENANCE=false
+
+# Bounded text prefix per federated content snapshot.
+RUSTY_RED_FEDERATE_SNAPSHOT_TEXT_BYTES=4096
+
 # ============================================================
 # Storage mode and durability
 # ============================================================