U7 — tells a website builder what they need to know

WEBSITE_WORKSPACE.md, plus the parts of the README that were still
describing the old layout or a manual step the code doesn't need
anymore (the key-ring paragraph, mainly - that one was actively
wrong now, not just stale).

frontend/.env.example

@@ -1,4 +1,9 @@
 # Base URL of the SlpModularCms .NET API.
+#
+# Leave this empty (or unset) for the production default: the SPA and the API are served by the
+# same process, so an empty value means same-origin — requests use relative paths and no CORS
+# configuration is needed at all. An explicit absolute URL is still honoured and required for local
+# development, where the frontend dev server and the backend run on different ports:
 # The backend must be running with CORS configured to allow this origin
 # and to send the httpOnly refresh-token cookie (credentials: include).
 # Set CookieSameSite=None in appsettings.Development.json so the cookie
@@ -10,6 +15,21 @@ VITE_API_BASE_URL=https://localhost:7221
 # (e.g. local master vs. slave, see below).
 VITE_APP_TITLE=SlpModularCms
 
+# --- Observability (all optional — absent is a supported state, not an error) ---
+
+# Sentry DSN for the admin SPA. Absent or empty skips Sentry initialisation entirely; only console
+# logging remains active. Not sensitive — safe to expose in the client bundle.
+VITE_SENTRY_DSN=
+
+# Environment tag attached to Sentry events (e.g. "test", "production"). Set per-environment by the
+# CI pipeline (see .gitea/workflows/continuous_integration.yaml) — leave empty for local development.
+VITE_APP_ENV=
+
+# Umami analytics script host and this environment's website ID. Both absent means the Umami
+# component renders nothing — leave unset for local development.
+VITE_UMAMI_SCRIPT_URL=
+VITE_UMAMI_WEBSITE_ID=
+
 # --- Local master/slave dev setup ---
 # To point the frontend at the slave instance (SlpModularCms.Api.Slave,
 # see root README.md "Lokaal Master + Slave Draaien (Dev)") instead of the