feat: add error reporting token validation and update documentation

docs/error-reporting.md

@@ -1,17 +1,18 @@
 # Error Reporting API
 
 ## What it does
-Accepts structured error reports and forwards them to Discord in a clean format.
+Accepts structured error reports and forwards them to Discord in a clean format. Submissions require a shared secret header so random users cannot spam your webhook.
 
 ## How to use
-- Set `DISCORD_WEBHOOK_URL` in your environment.
-- Send a POST request to `/api/report-error` with JSON that includes at least `error`.
+- Set `DISCORD_WEBHOOK_URL` and `ERROR_REPORT_TOKEN` in your environment (e.g., Vercel project settings → Environment Variables).
+- Send a POST request to `/api/report-error` with header `x-error-report-token: <your token>` and JSON that includes at least `error`.
 - Optional fields: `summary`, `type`, `metadata` (object), `environment` (string or object with `name`).
 
 ## Example
 ```bash
 curl -X POST https://your-deployment.vercel.app/api/report-error \
   -H "Content-Type: application/json" \
+  -H "x-error-report-token: YOUR_TOKEN" \
   -d '{"error":"Search job failed","type":"search","metadata":{"account":"user@contoso.com"}}'
 ```
 

docs/scheduling.md

@@ -7,6 +7,8 @@ Runs the bot automatically at set times.
 - Turn on scheduling in `src/config.jsonc` under `scheduling.enabled`.
 - Choose a time using the cron or Task Scheduler fields already in the config.
 - Leave the machine or container running so the schedule can trigger.
+- Check the console after start: it prints the next run time. If you close the window or stop the container, the scheduler stops.
+- Serverless hosts (e.g., Vercel) will not keep the scheduler alive; run on a machine or container that stays on.
 
 ## Example
 ```jsonc