Root, CI, docs and packaging describe the project to a stranger (#6225)

#6225 "Comment standard sweep: root, config, CI workflows, docs and
packaging", milestone 546 "Bring the repo to the comment standard (rule 32)
and compose defaults (rule 198)".

- README restructured in newcomer order: what it is, quick start,
  configuration, setup pitfalls, updating and backups, features,
  troubleshooting, development, licence. Its quick-start compose carries
  no restart policy.
- Dockerfile and .env.example trimmed to one or two lines per setting.
- Workflows, packaging scripts and docs lose issue, run, note, rule and
  milestone references and their history narration. Comments that still
  described path filters and "step 6" as future work now state what the
  workflows do.
- ci-requirements.md rewritten against the current workflows. It said the
  build gated on typecheck and lint only, the integration lane did not
  gate, a v* tag published :latest, and ci-tauri lacked bsdtar and zstd;
  none of those is true now (the last checked against run 9630's log).
- Echo strings in guard-forward.sh and version.sh drop their note
  citations; every string a test asserts on is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -9,44 +9,30 @@
 
 # --- required ---------------------------------------------------------------
 
-# Generate one and keep it: changing it later means also changing it inside the
-# database, or Postgres will reject the app's connection.
+# Generate one and keep it: changing it later means changing it inside the database
+# too. Letters and digits only — it goes into a URL, where `@ / : #` break it.
 #
 #   openssl rand -base64 24 | tr -d '/+=' | head -c 32
-#
-# Stick to letters and digits. This value goes into a connection URL, so a `@`,
-# `/`, `:` or `#` in it will be misparsed as URL structure rather than password.
 POSTGRES_PASSWORD=
 
 # --- optional ---------------------------------------------------------------
 
-# Which build to run.
-#
-#   latest        tracks the `main` branch — the production line (default)
-#   dev           tracks the `dev` branch — newer, less settled
-#   <commit sha>  pins one exact build; every push publishes one, and this is
-#                 the rollback lever when an upgrade misbehaves
-#
-# NOTE: `main` can sit well behind `dev`. If a feature you expect is missing,
-# check which branch it actually landed on before assuming a bug.
+# Which build: `latest` (the `main` branch, default), `dev` (newer, less settled),
+# or a commit sha on `main` to pin one exact build — the rollback lever.
 #INKWELL_TAG=latest
 
 # The host port the app is published on.
 #INKWELL_PORT=5000
 
-# Which interface to bind. The default (all interfaces) is what lets desktop
-# clients on your network reach the server. Behind a reverse proxy, set this to
-# 127.0.0.1 so only the proxy can talk to it.
+# Which interface to bind. Behind a reverse proxy, set 127.0.0.1 so only the proxy
+# can reach the app.
 #INKWELL_BIND=0.0.0.0
 
-# NOTE: how many proxies sit in front of this app is a SETTING, not an env var —
-# Settings → Security → "Trusted proxy hops" in the admin UI. It defaults to 1 (one
-# reverse proxy terminating HTTPS) and belongs there because it is something you may
-# need to change while the server is running, alongside the sign-in limits.
+# How many proxies sit in front is a setting, not an env var: Settings → Security →
+# "Trusted proxy hops" (default 1).
 
-# How much the app says. Credential events (sign-ins, failures, throttles, new
-# accounts, device tokens issued) are logged at INFO and read with
-# `docker compose logs app`.
+# How much the app logs. Credential events (sign-ins, failures, throttles, device
+# tokens issued) log at INFO; read them with `docker compose logs app`.
 #INKWELL_LOG_LEVEL=INFO
 
 # Database identity. Changing these AFTER the first start does not rename anything
@@ -70,14 +56,13 @@ POSTGRES_PASSWORD=
 #POSTGRES_USER=thoughtsync
 #POSTGRES_DB=thoughtsync
 #
-# Rename any THOUGHTSYNC_* lines already in your .env to INKWELL_* — the old
-# names are no longer read.
+# Rename any THOUGHTSYNC_* lines already in your .env to INKWELL_*; the old names
+# aren't read.
 
 # --- a note on HTTPS --------------------------------------------------------
 #
-# The app marks its session cookie Secure automatically when a request arrives over
-# HTTPS, directly or via a proxy setting X-Forwarded-Proto — no setting needed.
+# The session cookie is marked Secure automatically when a request arrives over
+# HTTPS, directly or via a proxy setting X-Forwarded-Proto.
 #
-# Worth knowing if you use the desktop app: typing a bare hostname there defaults to
-# https://, deliberately, so a device token never crosses the wire in cleartext by
-# accident. Serving over plain HTTP means typing the `http://` yourself.
+# The desktop and Android apps read a bare hostname as https://, so a server on
+# plain HTTP has to be typed with its `http://`.