Initial commit: gitignore and env example

Establishes the secrets-handling contract for this repo: real env values
live in a local .env (gitignored from the first commit), and only the
sanitized .env.example with placeholder values is tracked.

.env.example documents the env surface for the v1 deployment: PUBLIC_URL,
Authentik OIDC clients (web + MCP resource server), Postgres connection,
embedder sidecar, NextAuth secret, and log level.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,48 @@
+# =============================================================================
+# shared-memory — example environment file
+# Copy to `.env` and fill in real values. Never commit `.env`.
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Public URL the app is reached at.
+# Used for OIDC redirect URIs, MCP discovery metadata, and the Caddy site name.
+# -----------------------------------------------------------------------------
+PUBLIC_URL=https://memory.example.com
+
+# -----------------------------------------------------------------------------
+# Authentik OIDC
+# Create two Applications in Authentik (one for the Web UI, one for the MCP
+# resource server). See README.md for the exact provider settings.
+# -----------------------------------------------------------------------------
+OIDC_ISSUER=https://auth.example.com/application/o/shared-memory/
+OIDC_CLIENT_ID_WEB=replace-me
+OIDC_CLIENT_SECRET_WEB=replace-me
+OIDC_CLIENT_ID_MCP=replace-me
+OIDC_AUDIENCE=shared-memory
+
+# -----------------------------------------------------------------------------
+# Database (Postgres 16 + pgvector)
+# Default values match the docker-compose `db` service.
+# -----------------------------------------------------------------------------
+POSTGRES_USER=memory
+POSTGRES_PASSWORD=replace-me-with-a-strong-password
+POSTGRES_DB=memory
+DATABASE_URL=postgres://memory:replace-me-with-a-strong-password@db:5432/memory
+
+# -----------------------------------------------------------------------------
+# Embedder sidecar (added in Phase 2)
+# -----------------------------------------------------------------------------
+EMBEDDER_URL=http://embedder:8080
+EMBEDDING_MODEL=Xenova/bge-small-en-v1.5
+EMBEDDING_DIM=384
+
+# -----------------------------------------------------------------------------
+# NextAuth session signing — generate with: openssl rand -base64 32
+# -----------------------------------------------------------------------------
+NEXTAUTH_SECRET=replace-me-with-32-bytes-of-random
+
+# -----------------------------------------------------------------------------
+# App
+# -----------------------------------------------------------------------------
+LOG_LEVEL=info
+NODE_ENV=production