did something

.env.example

@@ -41,6 +41,15 @@ NATS_URL=nats://localhost:4222
 #   openssl ecparam -genkey -name prime256v1 -noout -out signing-key.pem
 # ARTIFACT_SIGNING_KEY=
 
+# ─── SSH Server ────────────────────────────────────────────────────────────────
+# Hostname shown in SSH clone URLs. Auto-detected from INSTANCE_URL or request
+# Host header when empty.
+# SSH_HOST=ssh.example.com
+# SSH_PORT=2222
+# Path to PEM-encoded SSH host key. If empty, an ephemeral RSA-4096 key is
+# generated at startup (host key changes on restart — warns clients).
+# SSH_HOST_KEY_PATH=
+
 # ─── OCI Registry (Phase 4) ───────────────────────────────────────────────────
 # Root directory for the OCI Distribution Spec blob and upload storage.
 OCI_ROOT=/var/lib/forgebucket/oci