Fix PCM auth: login for API token and multi webhook secrets.

PCM DirectMail v3 needs POST /auth/login (apiKey+apiSecret) before design/order calls; accept each subscription's copy-only signature secret via PCM_WEBHOOK_SECRETS.

.env.prod.example

@@ -53,10 +53,15 @@ SMTP2GO_SMS_API_KEY=replace-me
 # Email + SMS event webhook auth. SMTP2GO Authorization header = Bearer + this value.
 SMTP2GO_WEBHOOK_SECRET=replace-me
 
-# Postcards — PCM Integrations
+# Postcards — PCM Integrations (key+secret → POST /auth/login → Bearer token)
 POSTCARD_PROVIDER=pcm
 PCM_API_KEY=replace-me
-PCM_WEBHOOK_SECRET=replace-me
+PCM_API_SECRET=replace-me
+# PCM_CHILD_REF_NBR=
+# One signature secret per PCM webhook subscription (comma-separated).
+PCM_WEBHOOK_SECRETS=replace-me,replace-me-2
+# PCM_WEBHOOK_SECRET=replace-me  # optional single-secret alias
+
 # JSON return address for postcard orders
 PCM_RETURN_ADDRESS={"firstName":"Monica","lastName":"Dhillon","address":"replace-me","city":"replace-me","state":"IL","zipCode":"replace-me"}
 # LOB_API_KEY=  # only if POSTCARD_PROVIDER=lob