Add deploy instructions and pin account config to .dev.vars

- Add Deploying section to README with wrangler setup steps
- Add deployment info to CLAUDE.md for agent context
- Add .dev.vars to .gitignore (stores API token + account ID)
- Remove account_id from wrangler.toml (loaded from env instead)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

.gitignore

@@ -2,6 +2,7 @@ node_modules/
 dist/
 data/
 .env
+.dev.vars
 *.db
 *.db-wal
 *.db-shm

CLAUDE.md

@@ -5,3 +5,12 @@
 All scoring constants, thresholds, detection patterns, and scoring functions live in `src/scoring.ts`. This is the single source of truth for how PRs are ranked.
 
 **Important:** When you modify `src/scoring.ts` (changing thresholds, adding/removing signals, adjusting weights), you MUST also update the scoring documentation in `README.md` to keep them in sync. The README describes the algorithm in plain English for contributors — it should always reflect what the code actually does.
+
+## Deployment
+
+The dashboard is deployed as a Cloudflare Worker via `npx wrangler deploy`. Credentials are in `.dev.vars` (gitignored):
+
+- `CLOUDFLARE_API_TOKEN` — scoped API token with Workers Scripts + D1 permissions
+- `CLOUDFLARE_ACCOUNT_ID` — the target Cloudflare account
+
+To deploy: `source .dev.vars && export CLOUDFLARE_API_TOKEN CLOUDFLARE_ACCOUNT_ID && npx wrangler deploy`

README.md

@@ -4,6 +4,30 @@ The PR triage dashboard for [paperclipai/paperclip](https://github.com/paperclip
 
 **Live dashboard:** https://pr-triage.bippadotta.workers.dev
 
+## Deploying
+
+The dashboard runs as a Cloudflare Worker with a D1 database.
+
+1. Install dependencies:
+   ```bash
+   npm install
+   ```
+
+2. Create a `.dev.vars` file in the project root with your Cloudflare credentials:
+   ```
+   CLOUDFLARE_API_TOKEN=your-api-token
+   CLOUDFLARE_ACCOUNT_ID=your-account-id
+   ```
+
+   To create an API token, go to https://dash.cloudflare.com/profile/api-tokens and create a Custom Token with **Workers Scripts: Edit** and **D1: Edit** permissions.
+
+3. Deploy:
+   ```bash
+   npx wrangler deploy
+   ```
+
+`.dev.vars` is gitignored and should never be committed.
+
 ## How scoring works
 
 Every PR receives a **composite score from 0 to 180**, built from ten signals. The goal is to surface PRs that are most likely to be worth reviewing right now — small, well-tested PRs from reliable contributors with passing CI will naturally float to the top.