chore: track .env.example (un-ignore from .env.* rule)

The prior commit's .env.example was silently dropped by the .env.*
gitignore rule. Add a "!.env.example" negation so the documented
template (placeholders only, no secrets) is tracked.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,30 @@
+# ScreenTinker server configuration — process environment variables.
+#
+# NOTE: the app reads these from the *process environment* (your systemd unit's
+# Environment=/EnvironmentFile=, your container runtime, or your shell). It does
+# NOT auto-load this file. Copy the values you need into your process manager.
+# This file exists only to document the available options.
+
+# --- Self-hosting ---
+# Set to "true" on your own instance. When true, the hosted signup emails
+# (welcome to the user + admin notification) are disabled, so a self-hosted
+# instance never emits mail from a domain that isn't yours.
+SELF_HOSTED=true
+
+# Where new-signup admin notifications are sent. Leave UNSET to disable admin
+# notifications entirely — the user's welcome email is unaffected. Self-hosters
+# who want to be notified of signups set this to their own address.
+# ADMIN_NOTIFY_EMAIL=you@example.com
+
+# --- Outbound email (Microsoft Graph, client-credentials flow) ---
+# Required for ANY email (welcome, offline alerts, admin notify) to actually
+# send. Leave blank and the app logs "[EMAIL] not configured" instead of sending.
+# GRAPH_TENANT_ID=
+# GRAPH_CLIENT_ID=
+# GRAPH_CLIENT_SECRET=
+# GRAPH_SENDER_EMAIL=signage@example.com
+# GRAPH_SENDER_NAME=ScreenTinker
+# Dev safety net: comma-separated allow-list of recipients. When set, mail to
+# any address NOT in the list is suppressed (logged, not sent). Leave UNSET in
+# production. Useful locally so test signups can't email real users.
+# GRAPH_DEV_RESTRICT_TO=me@example.com

.gitignore

@@ -40,6 +40,8 @@ Thumbs.db
 # Environment
 .env
 .env.*
+# ...but DO track the documented template (placeholders only, no secrets)
+!.env.example
 
 # Local-only marketing assets
 video/