diff --git a/DOCKER.md b/DOCKER.md
index 4179c07..e5d2463 100644
--- a/DOCKER.md
+++ b/DOCKER.md
@@ -36,11 +36,11 @@ this compose file's own `redis` service (`docker-compose.yml` defaults
 Full reference: `.env.example` (each var has an inline comment).
 Summary, grouped the same way:
 
-| Group | Vars | Notes |
-|---|---|---|
-| Works out of the box | `COOKIE_SECURE=false` | Required (or set `PUBLIC_ORIGIN`/`TRUST_PROXY`) for a zero-config boot — `server/src/config.ts` fails closed otherwise. |
-| Must be set | `CONTEXTFORGE_URL` | No safe default reaches your gateway from inside the container. **No boot-time check catches a missing/wrong value** — it just fails every `/api/*` call at request time. Top thing to check if API calls all connection-refuse. |
-| Fine as-is for dev | `PORT`, `HOST`, `CONTEXTFORGE_AUTH_HEADER_NAME`, `SESSION_TTL_SECONDS`, `REDIS_KEY_PREFIX`, `COOKIE_DOMAIN`, `TRUST_PROXY`, `PUBLIC_ORIGIN`, `SSE_SESSION_RECHECK_SECONDS`, `LOG_LEVEL` | Defaults match `server/src/config.ts`. |
+| Group                | Vars                                                                                                                                                                                    | Notes                                                                                                                                                                                                                            |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Works out of the box | `COOKIE_SECURE=false`                                                                                                                                                                   | Required (or set `PUBLIC_ORIGIN`/`TRUST_PROXY`) for a zero-config boot — `server/src/config.ts` fails closed otherwise.                                                                                                          |
+| Must be set          | `CONTEXTFORGE_URL`                                                                                                                                                                      | No safe default reaches your gateway from inside the container. **No boot-time check catches a missing/wrong value** — it just fails every `/api/*` call at request time. Top thing to check if API calls all connection-refuse. |
+| Fine as-is for dev   | `PORT`, `HOST`, `CONTEXTFORGE_AUTH_HEADER_NAME`, `SESSION_TTL_SECONDS`, `REDIS_KEY_PREFIX`, `COOKIE_DOMAIN`, `TRUST_PROXY`, `PUBLIC_ORIGIN`, `SSE_SESSION_RECHECK_SECONDS`, `LOG_LEVEL` | Defaults match `server/src/config.ts`.                                                                                                                                                                                           |
 
 The image itself (`Dockerfile`) sets **none** of these — it ships
 respecting `config.ts`'s own defaults untouched. All configuration comes
diff --git a/README.md b/README.md
index fa61707..a88acb1 100644
--- a/README.md
+++ b/README.md
@@ -4,14 +4,14 @@ The web interface for ContextForge, the open source AI gateway that federates
 tools, agents, and APIs into one endpoint.
 
 The backing service is a separate process in a separate repository
-([IBM/mcp-context-forge](https://github.com/IBM/mcp-context-forge)). 
+([IBM/mcp-context-forge](https://github.com/IBM/mcp-context-forge)).
 This repository holds the BFF and client that sit in front of it. The table below also documents the API for naming reference, though it lives in a separate repo:
 
-| Component | Lives in | Role |
-| --------- | -------- | ---- |
-| **ContextForge API** | separate repo | FastAPI service that owns auth and all business data |
-| **BFF** | `server/` | Fastify app holding the session/CSRF boundary in front of the API |
-| **Client** | `src/` | React SPA, served as static files by the BFF |
+| Component            | Lives in      | Role                                                              |
+| -------------------- | ------------- | ----------------------------------------------------------------- |
+| **ContextForge API** | separate repo | FastAPI service that owns auth and all business data              |
+| **BFF**              | `server/`     | Fastify app holding the session/CSRF boundary in front of the API |
+| **Client**           | `src/`        | React SPA, served as static files by the BFF                      |
 
 Throughout this README, "the API", "the BFF", and "the client" refer to those
 three. The browser only ever talks to the BFF, never directly to the API.