Updated CLAUDE.md and deployment script

CLAUDE.md

@@ -30,7 +30,7 @@ npm run lint      # eslint
 
 ### Docker
 ```powershell
-.\build-budget-image.ps1   # builds multi-stage image and pushes to docker.stwaddle.com/budget:latest
+.\deploy.ps1   # builds image, pushes to docker.stwaddle.com/budget:latest, and deploys to prod via SSH
 ```
 
 ## Architecture
@@ -71,11 +71,18 @@ src/
 - **Inline table editing**: rows show read-only data; clicking a cell enters edit mode in-place using a `useState(editing)` toggle. New rows use a separate input row appended to `<tbody>` (not a modal).
 - **Sorting**: `SortableHeader` component and `SortState` type in `src/components/SortableHeader.tsx`. Sorting is client-side only and derives a view from the drag-ordered `displayItems` array — clearing sort restores drag order. Drag handles are disabled while a sort is active.
 - **Frequency calculations** for real-time previews are in `src/utils/frequency.ts`, mirroring the C# `FrequencyCalculator` exactly.
+- **Drag-and-drop ordering**: `@dnd-kit` is used on income/outgo rows. Row order is persisted to the server. Sort handles are hidden while a column sort is active.
 - **Auth**: `react-oidc-context` wraps the whole app; `AuthGuard` protects all budget routes; `TokenSync` wires the OIDC access token into the API client on every auth state change. After OIDC callback, navigation uses `window.location.replace('/')` (not `history.replaceState`) so React Router picks up the URL change.
 
+### Local development environment
+Required env vars when running the API locally (set in `appsettings.Development.json` or shell):
+- `ConnectionStrings__DefaultConnection` — Postgres connection string
+- `Oidc__Audience` — `budget_api`
+- `OTEL_EXPORTER_OTLP_ENDPOINT` — optional; omit or set to skip telemetry export
+
 ### Auth / OIDC
 - Authority: `https://auth.stwaddle.com/` (OpenIddict-based, at `src.Auth.Server` in a sibling repo)
-- API audience claim: `budget-api` (must match `AUTH__AUDIENCE` env var)
+- API audience claim: `budget_api` (underscore — must match `Oidc__Audience` env var)
 - Scope: `budget_api` (underscore, not hyphen)
 - Roles `admin` and `user` are granted per-user on the client registration in the auth server admin panel. A user with no role gets `access_denied` at the authorize endpoint.
 - Frontend OIDC config is baked into the build via `VITE_*` env vars; override locally in `src/Budget.Client/.env.local`