move secrets to env variables add palworld commands

AGENTS.md

@@ -10,7 +10,7 @@ docker compose logs -f                # View Docker logs
 
 ## Setup
 
-1. Set `DISCORD_BOT_TOKEN` env var (preferred) or edit `appsettings.json`
+1. Set `DISCORD_BOT_TOKEN` env var — secrets must not be stored in `appsettings.json`
 2. Copy `.env.example` to `.env` for Docker: `cp .env.example .env`
 3. `appsettings.json` is gitignored — never commit it
 
@@ -22,6 +22,18 @@ docker compose logs -f                # View Docker logs
 
 Add new commands by creating a class in `Commands/` that extends `InteractionModuleBase<SocketInteractionContext>`. Commands are auto-discovered via `AddModulesAsync(typeof(Program).Assembly)`.
 
+## Secrets
+
+All secrets (API keys, passwords, tokens) must be read from environment variables — never from `appsettings.json`. Use `Environment.GetEnvironmentVariable()` directly in service constructors.
+
+| Secret | Env Var |
+|---|---|
+| Discord bot token | `DISCORD_BOT_TOKEN` |
+| LLM API key | `LLM_API_KEY` |
+| Palworld server password | `PALWORLD_PASSWORD` |
+
+Non-secret configuration (URLs, model names, numeric settings) may stay in `appsettings.json` via `IConfiguration`.
+
 ## Gotchas
 
 - **Two `DiscordSocketClient` instances** are created in `Program.cs` — one for the bot client and one passed into `InteractionService`. They are separate instances sharing the same config.