docs: architecture guide + full .env.example + gitattributes + Makefile note (TASK-687) (#222)

Grouped nice-to-haves called out in the pre-launch audit.

1. docs/architecture.md — new contributor-focused architecture doc.
   CLAUDE.md covers the same ground but is agent-oriented; this is the
   human companion. Covers backend layout, request flow, frontend /
   data model / CLI↔daemon model / agent integration / testing.

2. .env.example — extended to document every PAD_* variable in
   docs/deployment.md (core, database, real-time events, security,
   email). Existing Postgres/Redis + encryption secrets kept at the
   top; new variables grouped by concern with inline comments and
   safe defaults commented out.

3. .gitattributes — normalize LF line endings repo-wide, mark binary
   assets, and flag web/build + web/.svelte-kit as generated so they
   don't pollute GitHub linguist stats or PR diffs.

4. Makefile — CAUTION comment on `make install` noting that the
   `killall -9 pad` step is system-wide; anyone else's pad daemon on
   the same machine gets killed too. Designed for single-developer
   local setups; not for shared hosts.

Parent: PLAN-644.

.env.example

@@ -57,3 +57,66 @@ PAD_ENCRYPTION_KEY=
 # mobility (mobile roaming, VPN toggles, carrier NAT); enable only for
 # high-sensitivity deployments.
 # PAD_IP_CHANGE_ENFORCE=strict
+
+# ─────────────────────────────────────────────────────────────────────
+# Core server — see docs/deployment.md for full reference.
+# ─────────────────────────────────────────────────────────────────────
+
+# Listen address. 0.0.0.0 for containers, 127.0.0.1 for loopback-only.
+# PAD_HOST=0.0.0.0
+
+# Listen port.
+# PAD_PORT=7777
+
+# Public-facing base URL. Used to build invitation + password-reset links.
+# PAD_URL=https://pad.example.com
+
+# Writable data directory — SQLite DB, config, logs. Default: ~/.pad
+# PAD_DATA_DIR=/data
+
+# Log level: debug | info | warn | error
+# PAD_LOG_LEVEL=info
+
+# Operating mode: local | remote | docker | cloud. Controls how the CLI
+# discovers the daemon and which credential keying rules apply.
+# PAD_MODE=docker
+
+# ─────────────────────────────────────────────────────────────────────
+# Database — SQLite default; set PAD_DB_DRIVER=postgres for Postgres.
+# ─────────────────────────────────────────────────────────────────────
+
+# PAD_DB_DRIVER=postgres
+# PAD_DB_PATH=/data/pad.db                       # SQLite path, ignored on Postgres
+# PAD_DATABASE_URL=postgres://pad:secret@postgres:5432/pad?sslmode=disable
+
+# ─────────────────────────────────────────────────────────────────────
+# Real-time events — cross-instance SSE fan-out via Redis pub/sub.
+# Without this, SSE stays in-process (fine for single-node).
+# ─────────────────────────────────────────────────────────────────────
+
+# PAD_REDIS_URL=redis://redis:6379
+
+# Global cap on concurrent SSE connections (default: 1000).
+# PAD_SSE_MAX_CONNECTIONS=1000
+
+# Per-workspace cap on concurrent SSE connections (default: 100).
+# PAD_SSE_MAX_PER_WORKSPACE=100
+
+# ─────────────────────────────────────────────────────────────────────
+# Security hardening for production behind TLS.
+# ─────────────────────────────────────────────────────────────────────
+
+# Set Secure flag on session cookies — requires TLS.
+# PAD_SECURE_COOKIES=true
+
+# Comma-separated list of allowed CORS origins. Leave unset to disable CORS.
+# PAD_CORS_ORIGINS=https://pad.example.com,https://app.example.com
+
+# ─────────────────────────────────────────────────────────────────────
+# Transactional email via Maileroo. Optional — without it, workspace
+# invites fall back to CLI-copyable join codes.
+# ─────────────────────────────────────────────────────────────────────
+
+# PAD_MAILEROO_API_KEY=your-sending-key
+# PAD_EMAIL_FROM=noreply@example.com
+# PAD_EMAIL_FROM_NAME=Pad