Update README for file exchange path and new env vars

[dcellison]

Summary

Update README to reflect recent PRs:

1. File exchange section - files are now saved to per-user directories under the data directory (not inside the workspace), and FILE_RETENTION_DAYS enables automatic cleanup
2. Env var table - add GITHUB_NOTIFY_CHAT_ID (PR Route GitHub notifications to a separate Telegram group #182) and FILE_RETENTION_DAYS (PR Add age-based cleanup for uploaded files #188)

[dcellison]

Review by Kai

This is a documentation-only PR. The changes are accurate, internally consistent, and well-scoped.

One suggestion worth checking:

suggestion — README.md (lines ~78-79): The updated paths use DATA_DIR as a placeholder (DATA_DIR/memory/MEMORY.md, DATA_DIR/history/<chat_id>/), but the diff doesn't show DATA_DIR in the env var table. If it isn't already documented there (above the visible diff hunk), it should be added alongside GITHUB_NOTIFY_CHAT_ID and FILE_RETENTION_DAYS for consistency.

Everything else looks clean:

• The security bullet additions (history/memory directory blocking, per-service SSRF controls) are additive and not contradictory.
• The file exchange description correctly drops the old hardcoded files/ path in favor of the per-user data dir.
• FILE_RETENTION_DAYS=0 defaulting to disabled is clearly documented.
• The new GitHub notification routing section matches the env var entry.