WI-H04: Provision accounts and secrets

Problem

Agents cannot create accounts or handle credentials (agent-boundaries.md). Almost everything past the monorepo scaffold needs at least one of these four services, so this is the human item most likely to stall the build.

All four are £0 at this scale.

In scope

Service	Needed for	Produces
Cloudflare	Workers, Pages, R2, Hyperdrive	Account ID, API token
Neon	Postgres, plus ephemeral CI branches	Connection string, API token for branch create/delete
Clerk	Auth	Publishable key, secret key, webhook signing secret
Sentry	Errors	DSN, auth token

Also in scope:

Store CI credentials as GitHub repository secrets.
Store local credentials in .dev.vars (Wrangler) and .env.local — both gitignored.
Create a .env.example documenting every variable by name only, with no values.

Out of scope

Wiring bindings into wrangler.jsonc — WI-012.
Configuring the Neon-branch CI step — WI-006 (#7), which consumes the token created here.
Clerk application settings (OTP, providers) — WI-013.
Any paid tier. All four stay free; a paid upgrade is a separate decision needing an ADR.

Definition of done

All four accounts exist and are on free tiers.
Neon API token has permission to create and delete branches — ADR-0011 needs both, and a token that can create but not delete silently leaks branches until quota is exhausted.
Neon Postgres version recorded on the issue, so WI-006 can pin Docker to match.
Neon’s own connection pooler is disabled — ADR-0004. Stacking it under Hyperdrive is the anti-pattern most likely to bite.
GitHub repository secrets set for everything CI needs.
.env.example committed, listing variable names with no values.
git log -p | grep for each secret value returns nothing — verified before closing.
Confirmed no secret was pasted into an issue, PR, or commit message.

Verification

gh secret list --repo psifive/tabletop-tracker      # names only; values are never readable
git log -p | grep -i -E '<each secret value>'       # must return nothing

Cloudflare, Neon, Clerk and Sentry dashboards each show an active free-tier project.

Notes

This is the highest-priority human item. It is not on the critical path for #3 (monorepo scaffold), so do it in parallel — but #5, #7, and everything from WI-012 onward need some part of it.

If a secret is ever committed: rotate first, then clean history. In that order — history rewriting is slow and the exposure window is what matters.

Two settings here have consequences a long way downstream and are easy to get wrong once:

The Neon pooler must be off. Hyperdrive replaces it.
The Neon token must include delete, or CI leaks a branch per run.