docs(integration): Mira env vars + GCP pivot spec, deprecate Notion bridge

[arigatoexpress]

Draft PR description: docs/gcp-mira-cleanup

Title

docs(integration): Mira env vars + GCP pivot spec, deprecate Notion bridge

Summary

Docs-only cleanup. Brings the useful env-var documentation from the stranded docs/notion-mira-env-prep branch onto current main, adds a design spec for the GCP-native Mira integration, and marks the Notion-sourced bridge as planned-for-deprecation.

No production behavior change. No code paths are modified; no secrets or live values are added.

What changed

• .env.example
  • Adds THO_API_KEY_MIRA (optional partner API key for /api/v1/mira/*).
  • Adds PARTNER_WEBHOOK_SIGNING_KEY (shared HMAC secret for outbound partner webhooks).
  • Both keys are already referenced in code; this change only documents them in the example env file.
• docs/integration/gcp-mira-pivot-spec.md (new)
  • Design spec for moving the Mira bridge off Notion and onto a Firestore-first GCP operational data layer.
  • Covers proposed tools/gcp_mira_source.py interface, optional Cloud Pub/Sub ingestion, optional Cloud SQL mirror, and a phased migration plan.
• docs/integration/notion-bridge.md
  • Added deprecation notice pointing readers to the new GCP pivot spec.

Verification

• Branch rebased onto latest origin/main (merge-base == origin/main).
• ruff check . — clean.
• python -m pytest tests/test_healthz.py tests/test_api_v1.py tests/test_document_engine.py -q — 86 passed.
• npm --prefix frontend run build — green.
• Frontend npm run lint — one pre-existing unrelated error in OpsCopilot.jsx (err unused); not introduced by this docs-only branch.

Deployment impact

None. This branch changes documentation and the example env file only. It is safe to merge without a prod deploy window, but it will trigger the normal CI/test gate.

Follow-ups after merge

1. Close PR fix(deps): bump python-multipart to 0.0.27 and brace-expansion to 5.0.6 #189 (fix/dependabot-security-bumps) without merging — superseded by already-merged PR fix(security): patch python-multipart + brace-expansion (clears 7 Dependabot alerts) #191.
2. Delete remote branch docs/notion-mira-env-prep — its useful content has been ported here.
3. (Future, gated) Decide whether to implement the GCP Mira source module per the new spec.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d2287ffdcd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Correct the Mira key disablement wording

This comment says leaving THO_API_KEY_MIRA unset disables the Mira bridge, but main.require_partner_api_key() accepts the primary THO_API_KEY and any THO_API_KEY_* for all protected /api/v1/* routes, including /api/v1/mira/* as wired in main.py. In environments that still have a primary or another partner key configured, operators could believe Mira is disabled while the endpoints remain reachable; please describe this as only omitting the Mira-specific credential or add a real Mira route gate.

Useful? React with 👍 / 👎.