feat: externalize config via env vars

- Add .env.example with all configurable variables documented
  (DB URL, HTTP port/host, cookie, JWT issuer/keys, log level)
- Remove hardcoded -Dquarkus.http.host from Dockerfile ENTRYPOINT
  (application.properties already sets the default; env vars
  can now override it at runtime without conflicting with -D flags)

All env vars follow Quarkus's auto-binding convention:
property.key → PROPERTY_KEY (uppercase)

Most useful for production:
- QUARKUS_DATASOURCE_JDBC_URL: DB file path
- QUARKUS_HTTP_PORT: HTTP port
- QUARKUS_HTTP_HOST: bind interface
- APP_AUTH_COOKIE_SECURE: enable Secure flag behind HTTPS
- MP_JWT_VERIFY_PUBLICKEY_LOCATION: externalize RSA keys

Dockerfile

@@ -9,4 +9,4 @@ RUN chmod 775 /work /work/application \
 EXPOSE 8080
 USER 1001
 
-ENTRYPOINT ["./application", "-Dquarkus.http.host=0.0.0.0"]
+ENTRYPOINT ["./application"]