docs: dotenvx workflow for env files

.env.example moves to the repository root with dotenvx setup/run notes; the
README documents 'dotenvx run -f .env -- node tools/server.js' and the
Docker caveat (--env-file cannot read encrypted values).

.env.example

@@ -0,0 +1,18 @@
+# Image Cropper service credentials — the ONLY environment variables this app
+# uses. Everything else (URLs, port, domain catalog) is hardcoded in source.
+# Without these the rest of the app works and /cropper answers 503.
+#
+# This repository uses dotenvx-encrypted env files (.env, .env.production);
+# the private keys live in .env.keys (gitignored). To set up or change a value:
+#
+#   cp .env.example .env
+#   dotenvx set MINIO_SECRET_KEY "<value>" -f .env
+#   # then commit the encrypted .env
+#
+# Run locally:  dotenvx run -f .env -- node tools/server.js
+MINIO_ACCESS_KEY=
+MINIO_SECRET_KEY=
+AZURE_STORAGE_CONNECTION_STRING=
+NODERED_HTTP_USERNAME=
+NODERED_HTTP_PASSWORD=
+CARVEKIT_API_KEY=