docs: document cursor theme source state

README.md

@@ -177,10 +177,10 @@ with citations.
 | Service       | URL                                  | Credentials                |
 |---------------|--------------------------------------|----------------------------|
 | API docs      | <http://localhost:8050/docs>         | -                          |
-| MinIO console | <http://localhost:9001>              | `legacyhub` / `legacyhub-secret` |
+| MinIO console | <http://localhost:9001>              | use `.env` or `.env.example` placeholders; do not reuse literal secrets from docs |
 | OpenSearch    | <http://localhost:9200>              | -                          |
 | Qdrant UI     | <http://localhost:6333/dashboard>    | -                          |
-| Postgres      | `localhost:5440`                     | `legacyhub` / `legacyhub`  |
+| Postgres      | `localhost:5440`                     | use local runtime credentials from `.env`; docs intentionally avoid literal reusable values |
 
 ```bash
 # Count docs in OpenSearch

frontend/README.md

@@ -88,7 +88,11 @@ frontend/src/
 - **States** — skeleton shimmer instead of spinners wherever possible.
 - **Cursor** — `@teamhub/cursor-theme` supplies the shared TeamHUB cursor
   contract; Tailwind `cursor-pointer` and `cursor-not-allowed` utilities are
-  overridden in `src/styles/globals.css` to use `--teamhub-cursor-*`.
+  overridden in `src/styles/globals.css` to use `--teamhub-cursor-*`. The
+  dependency is currently declared as
+  `file:../../../Engines/engines/teamhub-cursor-theme` in `frontend/package.json`;
+  the current source package version is `0.1.0` from the Engines package
+  manifest, and the consumer is not yet pinned to a release tag.
 
 ### Key flows