fix(content-ingest, scripts): unify on JINA_API_KEY, no more silent free-tier fallback

docker-compose.yml and services/content-ingest/src/jina.ts have always
read JINA_API_KEY, but .env.example (and every local .env copied from
it) defined JINA_AI_API_KEY — so the paid key never actually reached
the container. It degraded gracefully to Jina's free/no-auth tier, so
nothing looked broken, but content-ingest has been running on free-tier
rate limits since day one, including on the deployed humain-vc
instance. scripts/jina-fetch-urls.mjs already carried a comment
documenting this exact mismatch as a deliberate workaround; standardized
on JINA_API_KEY everywhere instead of routing around it.

Production content-ingest on Railway now has JINA_API_KEY set (done
directly in the Railway dashboard) and has redeployed successfully.
DEPLOYMENT.md's "Known gaps" section updated to drop this entry.

Files changed:
- .env.example
- scripts/jina-fetch-urls.mjs
- DEPLOYMENT.md

Author: mpstaton

.env.example

@@ -3,7 +3,7 @@
 ANTHROPIC_API_KEY=your_api_key_here
 OPENAI_API_KEY=your_api_key_here
 PERPLEXITY_API_KEY=your_api_key_here
-JINA_AI_API_KEY=your_api_key_here
+JINA_API_KEY=your_api_key_here
 FIRECRAWL_API_KEY=your_api_key_here
 # Optional for services/social-search. The common-seven social packs default to
 # the self-hosted SearXNG container (no key needed). Only packs explicitly routed

DEPLOYMENT.md

@@ -110,7 +110,7 @@ credential handling).
 |---|---|
 | `workspace-service` | `NATS_URL` (`nats://${{nats.RAILWAY_PRIVATE_DOMAIN}}:4222`), `CLIENTS_ROOT=/data/clients`, `SESSION_STORE_PATH=/data/sessions.json`, `ID_JWKS_URL`, `ID_ISSUER`, `DIDI_AUTH=required`, `REQUIRED_ORG_ID=humain.vc`, `ACTIVE_CLIENT_ID=humain-vc`, `PORT=3001` (see gotcha below) |
 | `record-surrealdb-resolver` | `NATS_URL`, `SURREAL_URL`, `SURREAL_NS`, `SURREAL_DB`, `SURREAL_USER`, `SURREAL_PASS` |
-| `content-ingest` | `NATS_URL`, `CLIENTS_ROOT=/clients`, `JINA_API_KEY` (**not currently set** — see [Known gaps](#known-gaps)) |
+| `content-ingest` | `NATS_URL`, `CLIENTS_ROOT=/clients`, `JINA_API_KEY` (paid-tier extraction) |
 | `prompt-runner` | `NATS_URL`, `ANTHROPIC_API_KEY` |
 | `shell` | `PUBLIC_WS_URL=wss://ws.augment.didi.sh/ws`, `PUBLIC_ID_BASE=https://id.didi.sh`, `PUBLIC_STRATEGY_CURATOR_REMOTE`, `PUBLIC_CHAT_REMOTE` (all build-time — baked in via Docker `ARG`/`ENV`, not read at runtime) |
 | `strategy-curator` | `PUBLIC_WS_URL`, `PUBLIC_STRATEGY_CURATOR_ASSET_PREFIX` (build-time) |
@@ -220,14 +220,6 @@ keyed by ID).
 
 ## Known gaps
 
-- **`JINA_API_KEY` naming mismatch.** `.env.example` and this repo's local
-  `.env` both define `JINA_AI_API_KEY`; `services/content-ingest/src/jina.ts`
-  actually reads `process.env.JINA_API_KEY` (no "AI"). Degrades gracefully
-  to Jina's free/no-auth tier when unset, so nothing has visibly broken —
-  but the deployed `content-ingest` is running on the free tier's rate
-  limits as a result. Either rename the var everywhere for consistency, or
-  set `JINA_API_KEY` (the name the code actually reads) on Railway with the
-  real key value.
 - **Corpus sync / backup.** The corpus lives on a single Railway Volume
   with no automated backup or sync-to-laptop story yet — the original plan
   assumed a DO box's filesystem an rclone cron job could reach directly,

scripts/jina-fetch-urls.mjs

@@ -12,8 +12,8 @@
 //   node scripts/jina-fetch-urls.mjs            # uses the MANIFEST below
 //   node scripts/jina-fetch-urls.mjs --dry-run  # fetch + report, write nothing
 //
-// Reads JINA_AI_API_KEY from augment-it/.env (Jina paid tier; the service
-// reads JINA_API_KEY in-container, but the committed .env var is JINA_AI_API_KEY).
+// Reads JINA_API_KEY from augment-it/.env (Jina paid tier — same var name
+// services/content-ingest/src/jina.ts reads in-container).
 
 import { readFile, writeFile, mkdir, readdir } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
@@ -55,10 +55,10 @@ const MANIFEST = [
 //         this exact reach.edu URL (caught by the exact_url dedupe).
 
 async function loadJinaKey() {
-  if (process.env.JINA_AI_API_KEY) return process.env.JINA_AI_API_KEY;
+  if (process.env.JINA_API_KEY) return process.env.JINA_API_KEY;
   try {
     const env = await readFile(join(REPO_ROOT, '.env'), 'utf8');
-    const m = env.match(/^JINA_AI_API_KEY=(.+)$/m);
+    const m = env.match(/^JINA_API_KEY=(.+)$/m);
     if (m) return m[1].trim().replace(/^["']|["']$/g, '');
   } catch {}
   return null;
@@ -179,7 +179,7 @@ function buildFrontmatter(item, r) {
 
 async function main() {
   const key = await loadJinaKey();
-  if (!key) console.warn('⚠  No JINA_AI_API_KEY found — trying free tier (lower rate limits).');
+  if (!key) console.warn('⚠  No JINA_API_KEY found — trying free tier (lower rate limits).');
   const seen = await existingUrls();
   let written = 0, skipped = 0, failed = 0;