Move .env.example where Compose actually looks, and make it true

It sat in backend/ while Compose reads .env from the repository root, so
the "cp .env.example .env" in the compose header pointed at nothing.

It also documented four settings that Compose never forwarded to the
container: ALLOWED_ORIGINS and the three version-retention knobs would
have been set in .env and silently done nothing. They are passed through
now, unset meaning the server's own defaults. Checked both directions:
every variable Compose reads is documented, and nothing documented is
ignored.

Dropped PORT from the example — the bundled nginx proxies to 4000 by
name, so changing it could only break that. Added the data-directory and
uid/gid settings, which were read but undocumented.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,51 @@
+# cp .env.example .env — and fill it in. Docker Compose reads .env from this
+# directory, next to docker-compose.yml; nothing looks for it anywhere else.
+#
+# Back the finished .env up together with the database: without ENCRYPTION_KEY
+# the stored notes cannot be read again, and a backup of one without the other
+# is worth nothing.
+
+# Signs session tokens. Changing it logs everyone out.
+#   openssl rand -hex 32
+JWT_SECRET=
+
+# Encrypts note bodies at rest. LOSING THIS MEANS LOSING THE NOTES.
+# Must be exactly 32 bytes as hex.
+#   openssl rand -hex 32
+ENCRYPTION_KEY=
+
+# The first administrator.
+#
+# There is no public sign-up — accounts are created by an admin inside the app
+# under Account → Administration. These two settle who the first one is:
+#
+#   empty database   → the account is created from both values
+#   existing users,  → INKNOTE_ADMIN_USER names which of them becomes admin.
+#   no admin yet       Without it, the oldest account is promoted.
+#   an admin exists  → both are ignored entirely
+#
+# So they can never reset an existing password or take rights away; the worst
+# they can do on a running instance is nothing.
+INKNOTE_ADMIN_USER=
+INKNOTE_ADMIN_PASSWORD=
+
+# ── Where the data lives ──
+# A plain directory on the Docker host, so the host's own backup covers it.
+# Create it before the first start:
+#   mkdir -p /srv/inknote/{db,uploads} && chown -R 1000:1000 /srv/inknote
+# INKNOTE_DATA_DIR=/srv/inknote     # dev compose defaults to ./data
+# INKNOTE_UID=1000                  # must own the directory above
+# INKNOTE_GID=1000
+
+# ── Optional tuning ──
+# Leave unset to keep the defaults shown.
+# MAX_VERSIONS_PER_NOTE=50          # versions kept per note
+# VERSION_RETENTION_DAYS=90         # and for how long
+# VERSION_COALESCE_MINUTES=5        # edits within this window share a version
+#
+# Only if the UI is served from a different host than the API. With a reverse
+# proxy in front, or the bundled nginx, leave it empty — same-origin needs none.
+# ALLOWED_ORIGINS=https://notes.example.com
+#
+# PORT is deliberately not here: the bundled nginx proxies to port 4000 by
+# name, so changing it would only break that.