[codex] Document backend environment variables

[vku2018]

Summary

• Add a safe, checked-in .env.example for the environment variables currently read by the backend.
• Document PORT, CORS_ALLOWED_ORIGINS, and NODE_ENV in README with defaults and runtime behavior.
• Keep real .env files ignored while explicitly unignoring .env.example.

Refs #54

Validation

• npm run build
• npm run lint
• git diff --check (passes with existing CRLF warnings only)
• git check-ignore -v .env .env.local .env.example (confirms .env / .env.local are ignored and .env.example is unignored)
• npm test (Windows shell cannot run the Unix-style NODE_ENV=test ... script directly)
• Windows equivalent: $env:NODE_ENV="test"; node --test dist/*.test.js dist/**/*.test.js ran 94 tests: 91 passed, 3 failed in pre-existing numeric-bounds expectations unrelated to this docs-only change
• npm run format / targeted Prettier check were attempted, but repo formatting is already noisy and Prettier has no parser for .env.example / .gitignore