chore(hygiene): stop tracking env — the credentials were rotated by the client; the pattern was still teaching

Arkhos's audit (2026-09-02) closed the credential alarm: the client rotated every key, so the
blob in history is history, not exposure. What remained was the PATTERN — a file named `env`
under version control, in a repo other Origin sites read as a template.

Measured before changing anything:
- docker-compose.yml never references `env`; it substitutes ${VARS} from a git-ignored `.env`.
- The tracked `env` lacks DB_USER/DB_PASSWORD/DB_NAME that compose requires, so no deployment
  can be reading it. Untracking it deletes nothing a VPS `git pull` depends on.

Changes:
- `git rm --cached env` (history untouched; the dead values stay where they were).
- `.gitignore`: `env` (the existing `.env*` rule never matched a dotless name).
- `env.example`: every key compose substitutes, placeholder values only.
- README.md: the environment note Arkhos suggested, plus the deploy one-liner.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitignore

@@ -57,3 +57,8 @@ public/branding/
 .mcp.json
 .claude/
 backups/
+
+# Environment files live OUTSIDE git. A file named `env` (no dot) sits in this repo's history
+# (4 commits, 2026); the client rotated every credential in it, so the values are dead — but the
+# PATTERN must not be copied by anyone using this repo as a template. Never track env files.
+env