ci(deploy): declarative env — CI writes service env from Gitea secrets

Previously /etc/gmw/*.env was managed by hand on the VPS; AI_LLM_* and
other vars drifted silently (AI_LLM_EMBEDDING_MODEL was missing until
added manually today). Now:
- BACKEND_ENV / GATEWAY_ENV secrets hold the full env block per service
- deploy.yml streams the secret to the VPS via stdin before the deploy
  (never through argv — no shell escaping issues, no secret exposure)
- env file chown'd gmw:gmw, chmod 600; empty secret = skip (no clobber)
- .env.example documents the declarative workflow

Update production env = edit the Gitea secret + push, never SSH by hand.

.env.example

@@ -1,5 +1,16 @@
 # Discord Bot Configuration
 # =============================================================================
+#
+# PRODUCTION ENV IS DECLARATIVE:
+# The runtime env files on the VPS (/etc/gmw/backend.env,
+# /etc/gmw/discord-gateway.env) are WRITTEN BY CI from Gitea Actions secrets
+# (BACKEND_ENV, GATEWAY_ENV) — see .gitea/workflows/deploy.yml.
+# To change production env: update the secret in Gitea repo settings
+# (Settings → Actions → Secrets), then push any commit to main. Never
+# SSH into the VPS to edit env files by hand — CI will overwrite them.
+#
+# This file documents every variable; values for production live in the
+# secrets, not here.
 
 # === Discord ===
 DISCORD_TOKEN=your_bot_token_here       # REQUIRED