feat(07-02): add S3/R2, DOMAIN, and MAX_UPLOAD_SIZE_MB vars to .env.example

- Add S3_ENDPOINT, S3_BUCKET, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY with MinIO dev defaults
- Add S3_USE_PATH_STYLE (true for MinIO, false for R2 virtual-hosted)
- Add MAX_UPLOAD_SIZE_MB=25 with default note
- Add commented DOMAIN=app.yourdomain.com for Caddy TLS in docker-compose.prod.yaml (D-04)
- Clarify TEST_DATABASE_URL is dev/test only and must not appear in .env.prod
- All original vars (DATABASE_URL, SESSION_SECRET, PORT, ENV) preserved

backend/.env.example

@@ -4,6 +4,7 @@ DATABASE_URL=postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable
 # Postgres connection string used by integration tests (auth, session, etc.).
 # Falls back to DATABASE_URL if unset; tests skip if neither is set.
 # The test harness creates an isolated schema per test run and drops it on cleanup.
+# DEV/TEST ONLY — do NOT include TEST_DATABASE_URL in .env.prod (not used at runtime).
 TEST_DATABASE_URL=postgres://xtablo:xtablo@localhost:5432/xtablo?sslmode=disable
 
 # Session secret — 32 random bytes hex-encoded. Used as the CSRF authentication key.
@@ -16,3 +17,39 @@ PORT=8080
 
 # Environment selector: "development" enables the slog text handler; "production" switches to JSON.
 ENV=development
+
+# ---------------------------------------------------------------------------
+# S3-compatible object storage (Cloudflare R2 in production, MinIO in dev)
+# ---------------------------------------------------------------------------
+
+# S3 endpoint URL.
+# Dev (MinIO):        http://localhost:9000
+# Production (R2):    https://<account-id>.r2.cloudflarestorage.com  (D-06)
+S3_ENDPOINT=http://localhost:9000
+
+# S3 bucket name.
+S3_BUCKET=xtablo-dev
+
+# S3 region. Cloudflare R2 accepts "auto" or a standard region token; "us-east-1" is safe default.
+S3_REGION=us-east-1
+
+# S3 access key (MinIO dev default: minioadmin).
+S3_ACCESS_KEY=minioadmin
+
+# S3 secret key (MinIO dev default: minioadmin).
+S3_SECRET_KEY=minioadmin
+
+# Use path-style S3 URLs.
+# true  — for MinIO and other self-hosted S3 (path-style: http://host/bucket/key).
+# false — for Cloudflare R2 (virtual-hosted-style: https://bucket.host/key).
+S3_USE_PATH_STYLE=true
+
+# Maximum file upload size in megabytes. Default 25 if unset.
+MAX_UPLOAD_SIZE_MB=25
+
+# ---------------------------------------------------------------------------
+# Production domain (used in docker-compose.prod.yaml for Caddy TLS — D-04)
+# ---------------------------------------------------------------------------
+
+# Uncomment and set to your domain in .env.prod.
+# DOMAIN=app.yourdomain.com