docs: document all environment variables in docker-compose, .env.example, and README

Made-with: Cursor

server/.env.example

@@ -1,34 +1,39 @@
-PORT=3000
+# ── Core ───────────────────────────────────────────────────────
+PORT=3001
 NODE_ENV=development
-DEBUG=false
+JWT_SECRET=your-super-secret-jwt-key-change-in-production
+TZ=UTC
+# info = concise user actions; debug = verbose admin-level details
 LOG_LEVEL=info
 
-# REQUIRED for production — generate with: openssl rand -hex 32
-JWT_SECRET=CHANGEME_GENERATE_WITH_openssl_rand_hex_32
-
-# Timezone (defaults to system timezone)
-# TZ=UTC
-
-# CORS — comma-separated origins (leave unset for same-origin in production, allow-all in development)
+# ── Networking ─────────────────────────────────────────────────
+# Comma-separated origins for CORS and email links
 # ALLOWED_ORIGINS=https://trek.example.com
-
-# Force HTTPS redirect (set to true behind TLS-terminating proxy)
-# FORCE_HTTPS=true
-
-# Trust proxy (set to number of proxy hops, e.g. 1 for single reverse proxy)
+# Redirect HTTP → HTTPS behind a TLS proxy
+# FORCE_HTTPS=false
+# Number of trusted proxies for X-Forwarded-For
 # TRUST_PROXY=1
 
-# Application URL (used for OIDC callback validation)
-# APP_URL=https://trek.example.com
-
-# Demo mode (enables demo login, disables registration)
-# DEMO_MODE=false
-
-# --- OIDC / SSO ---
+# ── OIDC / SSO ─────────────────────────────────────────────────
 # OIDC_ISSUER=https://auth.example.com
-# OIDC_CLIENT_ID=
-# OIDC_CLIENT_SECRET=
+# OIDC_CLIENT_ID=trek
+# OIDC_CLIENT_SECRET=supersecret
 # OIDC_DISPLAY_NAME=SSO
+# Disable local password auth entirely (SSO only)
 # OIDC_ONLY=false
 # OIDC_ADMIN_CLAIM=groups
 # OIDC_ADMIN_VALUE=app-trek-admins
+
+# ── SMTP (email notifications) ─────────────────────────────────
+# SMTP_HOST=smtp.example.com
+# SMTP_PORT=587
+# SMTP_USER=trek@example.com
+# SMTP_PASS=secret
+# SMTP_FROM=trek@example.com
+# SMTP_SKIP_TLS_VERIFY=false
+
+# ── Webhook (Discord / Slack notifications) ────────────────────
+# NOTIFICATION_WEBHOOK_URL=https://discord.com/api/webhooks/...
+
+# ── Demo ───────────────────────────────────────────────────────
+# DEMO_MODE=false