Put the OIDC set-up where it can be read

The .env.example had grown a page of prose around seven variables, which is
the wrong place for it: that file is read while editing, one line at a time.
It now names the variables and points at the readme.

The readme carries the whole thing instead, worked through with PocketID: the
client at the provider, the settings, the two lines the boot log can print,
and a table of what each failure looks like from the outside — including the
one that catches everyone, a server container that cannot reach an issuer the
browser reaches perfectly well.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -32,24 +32,12 @@ INKNOTE_ADMIN_PASSWORD=
 # VERSION_COALESCE_MINUTES=5
 # ALLOWED_ORIGINS=                  # only if the UI is on another host
 
-# ── Signing in through an identity provider (OpenID Connect) ──
-# Optional. Leave the four empty and the app is password-only; set all four and
-# the sign-in screen offers the provider as well. The password login stays in
-# either case — an unreachable provider must not lock anybody out of their own
-# notes. Somebody who signs in this way and has no account here yet gets one
-# (never an administrator: that is granted in the app, on purpose).
-#
-# In PocketID: a new OIDC client, redirect URI exactly
-#   https://<your-inknote-host>/api/auth/oidc/callback
-# The *server container* has to reach the issuer itself, not just your browser.
-#
-# The first sign-in binds an identity to an account of the same name here, so
-# this trusts the provider's usernames. Right for a provider whose names are set
-# by its own administrator; wrong for one where people pick their own.
+# ── Signing in through an identity provider (OIDC) ── optional, off when empty
+# Set-up and what it does: readme.md → Signing in through an identity provider
 # INKNOTE_PUBLIC_URL=https://notes.example.com
 # INKNOTE_OIDC_ISSUER=https://id.example.com
 # INKNOTE_OIDC_CLIENT_ID=
 # INKNOTE_OIDC_CLIENT_SECRET=
-# INKNOTE_OIDC_LABEL=PocketID        # what the button says: "Continue with …"
+# INKNOTE_OIDC_LABEL=PocketID        # the button says "Continue with …"
 # INKNOTE_OIDC_SCOPES=openid profile email
-# INKNOTE_OIDC_REDIRECT_URI=         # only if it is not <public url>/api/auth/oidc/callback
+# INKNOTE_OIDC_REDIRECT_URI=         # only if not <public url>/api/auth/oidc/callback