docs: dotenvx workflow for env files

.env.example moves to the repository root with dotenvx setup/run notes; the
README documents 'dotenvx run -f .env -- node tools/server.js' and the
Docker caveat (--env-file cannot read encrypted values).

README.md

@@ -72,8 +72,9 @@ identity photos. It reuses the YOUreka session for identity, requires the
 against the portal's OpenFGA endpoint — live on save, 5-minute cached on
 reads), and keeps the a2loft OTP requirement only on the save step.
 
-Its service credentials are the sole environment variables this app uses
-(same names the old `id-image-bot` used — an existing `.env` is drop-in):
+Its service credentials are the sole environment variables this app uses.
+They live in dotenvx-encrypted files at the repository root — `.env` for
+development, `.env.production` for deployment:
 
 ```sh
 MINIO_ACCESS_KEY=…            MINIO_SECRET_KEY=…
@@ -83,8 +84,18 @@ CARVEKIT_API_KEY=…
 ```
 
 Without them the rest of the app works and `/cropper` routes answer `503`.
-Run locally with `cp tools/.env.example tools/.env` + your values and
-`node --env-file=tools/.env tools/server.js` (or `docker run --env-file …`).
+The private decryption keys sit in `.env.keys` (gitignored, never commit it).
+
+```sh
+dotenvx run -f .env -- node tools/server.js          # local, from the repo root
+dotenvx set MINIO_SECRET_KEY "<value>" -f .env       # add/rotate a value
+```
+
+Deploying with Docker: `--env-file` cannot read encrypted values, so either
+decrypt at deploy time (`dotenvx decrypt -f .env.production --stdout` into a
+runtime env file) or pass `DOTENV_PRIVATE_KEY_PRODUCTION` into the container
+and run through `dotenvx` inside the image (ask if you want the Dockerfile
+wired for that).
 
 ## Tests