docs: make the README true, then show Braid running in it

.env.example

@@ -0,0 +1,89 @@
+# Copy to .env and fill in. Never commit the filled copy.
+# Compose reads it from this directory.
+# The image already sets BRAID_HOME, the port, and the Studio assets.
+# packages/server/README.md documents every variable the server reads.
+
+# ---------------------------------------------------------------------------
+# required
+# ---------------------------------------------------------------------------
+
+# server: the name users type, and the origin the API answers on.
+# Both Google redirects derive from it, so register each in the console.
+#   <url>/auth/google/callback    signing in
+#   <url>/oauth/google/callback   connecting a Drive source
+# Serving anybody else means putting the name they type here.
+BRAID_STUDIO_URL=http://localhost:4321
+
+# server: who may create workspaces and manage the roster.
+# Comma separated, at least one.
+BRAID_ADMIN_EMAILS=
+
+# server signs people in with these.
+# source-loader-gdrive connects a Drive source with them too.
+BRAID_GOOGLE_CLIENT_ID=
+BRAID_GOOGLE_CLIENT_SECRET=
+
+# agent-claude-code: one subscription seat, from `claude setup-token`.
+# Every run draws on it unless that person saved their own.
+# ANTHROPIC_API_KEY set alongside it wins, and the seat idles.
+CLAUDE_CODE_OAUTH_TOKEN=
+
+# ---------------------------------------------------------------------------
+# optional
+# ---------------------------------------------------------------------------
+# Leaving any of these empty turns the feature off.
+
+# server: restricts sign-in to these domains, comma separated.
+# Removing one closes the browser door and the MCP endpoint at once.
+BRAID_ALLOWED_DOMAINS=
+
+# source-loader-git: read access for a private remote.
+# PRODUCT.md references it as `oauth2:${GIT_TOKEN}@host`, never the value.
+GIT_TOKEN=
+
+# source-loader-github: an Issues source, connected per source rather than
+# by a token, so the issues a person can see are the ones Braid mirrors.
+# Register the callback on the GitHub App, and install the App on every
+# repository it reads, since an uninstalled one answers with nothing.
+#   <api>/oauth/github/callback
+# BRAID_GITHUB_CLIENT_ID=
+# BRAID_GITHUB_CLIENT_SECRET=
+
+# server: sign-in through your own authorization server.
+# An issuer displaces the Google client above and turns on the MCP endpoint.
+# Its tokens must carry an `email` claim, which is what names a Braid user.
+# BRAID_OIDC_ISSUER=https://keycloak.your-host/realms/braid
+# BRAID_OIDC_CLIENT_ID=braid-studio
+# BRAID_OIDC_CLIENT_SECRET=
+# BRAID_OIDC_AUDIENCE defaults to the API url.
+# compose.yaml omits it, since an empty value would not read as unset.
+
+# server: the read-only MCP endpoint, once an issuer exists above.
+# It exchanges each caller's token, so history records who asked.
+# BRAID_MCP_GATEWAY_CLIENT_ID=
+# BRAID_MCP_GATEWAY_CLIENT_SECRET=
+
+# compose.oidc.yaml runs Keycloak as one worked example, and
+# keycloak/init.sh provisions the realm with Google behind it.
+# These four are that example's own, not Braid's.
+# KC_BOOTSTRAP_ADMIN_PASSWORD=
+# KEYCLOAK_URL=http://localhost:8080
+# KEYCLOAK_API_SECRET=
+# KEYCLOAK_GATEWAY_SECRET=
+# Narrows Google to one workspace domain. Empty lets any account in.
+# GOOGLE_HOSTED_DOMAIN=
+
+# server: per-user agent credentials, from `openssl rand -base64 32`.
+# Each person then saves their own under Settings, and their runs spend it.
+# Without it nothing is stored, since a derivable key protects nothing.
+# BRAID_SECRET_KEY=
+# The key being rotated out, read and rewritten under the current one.
+# BRAID_SECRET_KEY_PREVIOUS=
+
+# server: search by meaning. The address is the switch.
+# Unset, the graph is searched by name and description alone.
+# Any OpenAI-compatible endpoint, Ollama included. Model defaults to bge-m3.
+# The server appends `/v1/embeddings`, so name the origin and stop there.
+# BRAID_EMBEDDING_HOST=http://ollama:11434
+# BRAID_EMBEDDING_MODEL=bge-m3:latest
+# BRAID_EMBEDDING_API_KEY=