chore(env): add 7 workflow tunables to .env.example (REQ-INB-33)

The .env.example file documented the IMAP, NocoDB, SeaweedFS,
Papra (bare connection vars), Ollama base URL, and Gitea env
blocks, but was missing 7 env vars that the workflows reference:

1. OLLAMA_API_KEY="" — empty by default (Ollama local is
   unauthenticated; the entry is for FRP-tunneled or remote
   Ollama where the operator has set a key)
2. INBOXOS_LLM_BACKEND=ollama — default backend; the v1.0
   production path is Ollama. The "opencode" backend is wired
   in pipelines/common.py::opencode_run_command but documented
   as offline-tests-only (common.py:455-461).
3. PAPRA_DRY_RUN=true — the v1.0 + v1.1 + v1.2 default. Set
   to "false" to enable live Papra writes (the Phase 6 /
   future-v1.x gate per docs/papra-write-policy.md).
4. PAPRA_BODY_WRITE_MODULES=crm,finance,legal — modules whose
   bodies (not just attachments) get written to Papra on the
   post-classify pass.
5. PAPRA_METADATA_ONLY_MODULES=intel,promotions — modules whose
   Papra write is metadata-only (no body upload).
6. MBOX_BUCKET= — historical pipeline's S3 bucket for the
   .mbox source; defaults to $SEAWEEDFS_S3_BUCKET if unset.
7. OPENCODE_NPM_VERSION=latest — historical pipeline's
   opencode CLI version.

This commit adds a new "Workflow tunables" section at the end
of .env.example containing all 7 commented-out entries with
workflow-baked defaults and 1-line explanations. The
INBOXOS_LLM_MODEL / INBOXOS_LLM_MODEL_EXTRACT block (lines
96-99) is unchanged (REQ-INB-15 / v1.1 P1-5 closure).

Verified: no literal token values are introduced (the
v1.0 secret-scan convention is honored: pre-existing
NOCODB_API_TOKEN=change-me-* / GITEA_PASS=change-me-* /
IMAP_PASSWORD=change-me-* are placeholder values, not real
secrets). No cto-inboxos references are introduced
(REQ-INB-28 / REQ-INB-37 / v1.1 P0 sweep closure preserved).

---ci---
project: inboxos
phase: 1
milestone: v1.3
status: execute
tasks_completed: [T3.1]
candidates_closed: [REQ-INB-33]
files_touched:
  - .env.example (1 file, 45 lines added at the end, new "Workflow tunables" section)
---/ci---

.env.example

@@ -97,3 +97,48 @@ OPENCODE_PROMPT_DIR=./.opencode/commands
 # INBOXOS_LLM_MODEL=gemma4:e4b  # canonical pin per REQ-INB-11 (do not change in production)
 # INBOXOS_LLM_MODEL_EXTRACT=gemma4:e4b  # same as INBOXOS_LLM_MODEL; the legacy two-model split was retired in v1.0
 # INBOXOS_LLM_TIMEOUT=120    # seconds per LLM call
+
+# ── Workflow tunables (REQ-INB-33) ──────────────────────
+# These env vars are referenced by the Gitea Actions workflows
+# (.gitea/workflows/live-pipeline.yml, historical-pipeline.yml,
+# ci-pr.yml) but are not surfaced in the example file. Defaults
+# below match the workflow-baked defaults; uncomment + edit to
+# override locally.
+
+# OLLAMA_API_KEY=""                  # empty by default; Ollama local is
+                                     # unauthenticated. Set only if your
+                                     # Ollama is FRP-tunneled and auth-gated.
+
+# INBOXOS_LLM_BACKEND=ollama         # default; the v1.0+ production path
+                                     # is Ollama. The "opencode" backend is
+                                     # wired in pipelines/common.py::
+                                     # opencode_run_command but documented
+                                     # as offline-tests-only (common.py:455-461);
+                                     # do not flip the default without
+                                     # reading the docstring.
+
+# PAPRA_DRY_RUN=true                 # v1.0+v1.1+v1.2 default. Set to
+                                     # "false" to enable live Papra
+                                     # writes (the Phase 6 / future-v1.x
+                                     # gate per docs/papra-write-policy.md).
+
+# PAPRA_BODY_WRITE_MODULES=crm,finance,legal         # modules whose bodies
+                                                     # (not just attachments)
+                                                     # get written to Papra
+                                                     # on the post-classify
+                                                     # pass.
+
+# PAPRA_METADATA_ONLY_MODULES=intel,promotions      # modules whose Papra
+                                                     # write is metadata-only
+                                                     # (no body upload).
+
+# MBOX_BUCKET=                       # historical pipeline's S3 bucket for
+                                     # the .mbox source. Defaults to
+                                     # $SEAWEEDFS_S3_BUCKET if unset.
+
+# OPENCODE_NPM_VERSION=latest        # historical pipeline's opencode CLI
+                                     # version (the opencode backend is
+                                     # offline-tests-only in production
+                                     # but the env var is still referenced
+                                     # by pipelines/common.py).
+# ── end Workflow tunables ──────────────────────────────