fix: correct Lore key wiring — require lore_sk_ prefix, drop dead LORE_MODE

.env.example

@@ -9,10 +9,13 @@
 COMPOSE_PROFILES=full
 #
 # These are LOCAL-DEV placeholders. Generate fresh values for any
-# non-local use (e.g. `openssl rand -hex 32`).
+# non-local use (e.g. `openssl rand -hex 32`) — EXCEPT LORE_API_KEY,
+# which must keep its `lore_sk_` prefix (see below).
 
-# API key AgentLens uses to call the Lore service. Must match a key the
-# Lore instance accepts.
+# API key AgentLens uses to call the Lore service, and the value Lore seeds
+# its root key from on first boot. MUST start with `lore_sk_` — Lore's auth
+# rejects any other format (Lore now refuses to boot without the prefix).
+# Generate one with:  echo lore_sk_$(openssl rand -hex 32)
 LORE_API_KEY=lore_sk_localdev_replace_me
 
 # AgentGate admin API key.

docker-compose.yml

@@ -21,7 +21,6 @@ services:
       - JWT_SECRET=${JWT_SECRET:?set JWT_SECRET in .env (copy from .env.example)}
       - AGENTGATE_URL=http://agentgate:3002
       - LORE_ENABLED=true
-      - LORE_MODE=remote
       - LORE_API_URL=http://lore:8765
       - LORE_API_KEY=${LORE_API_KEY:?set LORE_API_KEY in .env (copy from .env.example)}
     volumes: