Chatwoot, Arcane deployment

CLAUDE.md

@@ -84,11 +84,22 @@ Required for full functionality:
 
 ```
 RESEND_API_KEY              # Resend API key for contact form emails
-NEXT_PUBLIC_CHATWOOT_ACCOUNT_TOKEN  # Chatwoot widget token
+CHATWOOT_TOKEN              # Chatwoot website token (served at runtime via GET /api/chatwoot)
 ```
 
+Both are read server-side at **runtime**, so they can be supplied via Docker
+compose `env_file` — no build args or `NEXT_PUBLIC_` prefix needed. The
+Chatwoot token is intentionally not `NEXT_PUBLIC_`: the client widget fetches
+it from `/api/chatwoot` (a `force-dynamic` route) instead of having it inlined
+at build time.
+
 ## API Routes
 
+### GET /api/chatwoot
+
+Returns `{ "token": string | null }` — the Chatwoot website token read from
+the server environment at request time. Consumed by `components/chatwidget.tsx`.
+
 ### POST /api/send-email
 
 Sends contact form submissions to contact@cloudrite.co.nz via Resend.