diff --git a/.gitignore b/.gitignore
index a1a237f..6756f07 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,7 @@ build-cache/debs/*
 !build-cache/debs/.gitkeep
 build-cache/wheels/*
 !build-cache/wheels/.gitkeep
+
+# Private browser captures and platform metadata
+docs/screenshots/
+.DS_Store
diff --git a/docs/deployment/GITEA_CD.md b/docs/deployment/GITEA_CD.md
index 1a9fbc7..41a16a5 100644
--- a/docs/deployment/GITEA_CD.md
+++ b/docs/deployment/GITEA_CD.md
@@ -26,16 +26,16 @@ configured names and existing bind mounts, with `create_host_path: false`.
 
 Repository Settings → Actions configuration (private paths/addresses use Secrets):
 
-| Variable | Value to explicitly confirm |
+| Variable or Secret | Value to explicitly confirm |
 | --- | --- |
 | `PROD_DEPLOY_ENABLED` | Initially `false`; change to `true` only after plan acceptance |
 | `PROD_PROJECT` | Existing Compose project label; candidate `pigway-frame-flow` |
 | `PROD_CONTAINER` | Existing container name; candidate `pigway-frame-flow` |
 | `PROD_IMAGE_REPO` | Fixed local image repository; suggested `pigway-frame-flow` |
-| `PROD_DATA_DIR` | Existing absolute NAS host data path; no default |
-| `PROD_CONFIG_DIR` | Existing absolute NAS host config path; no default |
-| `PROD_PHOTOS_DIR` | Existing read-only photos source if present; otherwise empty |
-| `PROD_WEB_BIND` | Exact existing Docker HostIp (`0.0.0.0` or NAS LAN IP etc.) |
+| `PROD_DATA_DIR` (Secret) | Existing absolute NAS host data path; no default |
+| `PROD_CONFIG_DIR` (Secret) | Existing absolute NAS host config path; no default |
+| `PROD_PHOTOS_DIR` (Secret) | Existing read-only photos source if present; otherwise empty |
+| `PROD_WEB_BIND` (Secret) | Exact existing Docker HostIp (`0.0.0.0` or NAS LAN IP etc.) |
 | `PROD_WEB_PORT` | Exact existing mapped port |
 | `PROD_STATE_VOLUME` | Dedicated new deployment journal volume, e.g. `pigway-frame-flow-cd-state` |
 | `PROD_MOCK` | Explicit `true`/`false`, consistent with intended production mode |