Routine needs setup: recon-probe-volume-monitor missing 3 env vars + egress allowlist

## Recon probe volume monitor — needs_input (2026-06-21 12:00 UTC)

The daily security-monitoring routine ran but could not query Vercel logs or post to the admin mirror. Three things need to be added before the routine becomes useful.

---

### What's missing

| Variable | Where to add | Why |
|---|---|---|
| `VERCEL_TOKEN` | Routine environment variables | Authenticate Vercel Logs API to read 404/429 probe hits |
| `VERCEL_PROJECT_ID` | Routine environment variables | Scope the log query to the flashlearn-ai project |
| `ROUTINE_RUN_SECRET` | Routine environment variables | Auth header for POST to `flashlearnai.witus.online/api/routine-runs` |

Also: **`flashlearnai.witus.online` must be added to the routine's network egress allowlist** (the POST returned `403 Host not in allowlist`). Do this in the Claude Code on the web environment settings for this routine's trigger `trig_01NUfDoX6H3EkmcmHzsuFjnU`.

---

### How to get each value

- **VERCEL_TOKEN** — Vercel dashboard → Account Settings → Tokens → Create token (scope: read logs)
- **VERCEL_PROJECT_ID** — Vercel dashboard → flashlearn-ai project → Settings → General → Project ID
- **ROUTINE_RUN_SECRET** — The bearer token the `flashlearnai.witus.online/api/routine-runs` endpoint expects; check the FL-AI admin app env or Vercel environment variables for `ROUTINE_RUN_SECRET`

---

### What this blocks

Without these, the routine is a no-op. It cannot detect if any IP crosses the 500-probe-in-24h threshold or if >50 distinct IPs scan in a day — the conditions that would trigger opening the Option 2 (persistent IP ban list) PR per `plans/future/02-rate-limiting-ip-banning-botid.md`.

---

### How to close this

Once the three variables are set and `flashlearnai.witus.online` is in the egress allowlist, the next routine run (tomorrow 08:00 ET) will self-verify. Close this issue when the run posts `info` status to the dashboard.

**Routine trigger:** `trig_01NUfDoX6H3EkmcmHzsuFjnU`
**Routine session:** https://claude.ai/code/routines/trig_01NUfDoX6H3EkmcmHzsuFjnU

Start with routine trigger trig_01NUfDoX6H3EkmcmHzsuFjnU and its Claude Code on the web environment settings; verify the three named variables and the egress allowlist entry. Review plans/future/02-rate-limiting-ip-banning-botid.md for context, then confirm the next scheduled run posts an info status to the dashboard.

Written by the indexing model from the issue text.