Establishes the secrets-handling contract for this repo: real env values
live in a local .env (gitignored from the first commit), and only the
sanitized .env.example with placeholder values is tracked.
.env.example documents the env surface for the v1 deployment: PUBLIC_URL,
Authentik OIDC clients (web + MCP resource server), Postgres connection,
embedder sidecar, NextAuth secret, and log level.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
