Reconcile .env.example with the environment variables the server reads, and guard the drift

[atomantic]

Summary

• .env.example had drifted from what the server actually reads, in both directions. Every one of these variables is read lazily with a silent fallback, so an undocumented one is invisible — the feature just uses its default and nothing says otherwise.
• Documented 16 missing variables, each with a one-line comment naming its reading module and its default. The clearest gap: signalSync.js reads SIGNAL_DIR, SIGNAL_CONFIG_PATH and SIGNAL_DB_PATH in one three-line block and only the middle one was documented, so relocating a Signal install configured half of it.
• Removed one dead variable. PORTOS_UI_MAX_MEMORY was still advertised long after Configure portos-ui to restart before CoS memory warnings #5322 made the Vite ceiling a fixed constant — setting it did nothing.
• Added server/envExampleDrift.test.js, a guard for both directions, registered in ALWAYS_RUN_TESTS (any server file can add a process.env read, and .env.example is not a scope the CI selector routes anywhere).

Beyond the 13 variables the issue named, the same scan also turned up PORT, PYTHON_BIN and SLOTSTREAM_MODEL_DIR; all three are documented here too.

How the guard avoids false positives

• The forward scan blanks string and comment content first, so the process.env.X inside a vite config PortOS generates for a user is not mistaken for a PortOS setting.
• INHERITED_ENV is a category allowlist with a reason per entry — OS-, toolchain- and test-harness-provided names a user would never put in .env — rather than a snapshot of today's diff, so it keeps meaning something as the tree grows.
• The reverse scan is deliberately wide (every tracked code file, any language, anywhere in the repo) because a false "this is dead" would block CI over a real setting. Prose and test files are excluded so a doc mention cannot vouch for a key nothing reads.
• Known blind spots are stated in the file header and pinned by fixture assertions, so they cannot quietly become wrong.

All added values are placeholders. No real host, path, or credential appears anywhere in the diff.

Test plan

• cd server && npx vitest run envExampleDrift.test.js — passes in both directions (~0.5s).
• Bypass probe: temporarily adding an undocumented process.env.PORTOS_PROBE_UNDOCUMENTED read and a # PORTOS_PROBE_DEAD_VAR= line makes the guard fail on exactly those two, naming the file for the first. Both probes reverted.
• cd server && npm test — 37,674 passing. The 17 failures are pre-existing 10-second timeout flakes from running a large suite in a worktree under data/; all 9 affected files pass when run on their own.
• scripts/repo-scan-guards.test.js and scripts/ci-test-plan.test.js confirm the new scanner is registered.

Closes #5706