docs(env): add APP_BASE_URL and other security vars to .env.example

Task 1.1 疏漏：只更新了 AGENTS.md，漏了 .env.example。补上本次 review 引入及
原先缺失的 security 变量：
- APP_BASE_URL（CSRF 校验的可信 origin，1.1 引入）
- STATEMENT_TIMEOUT_SECS（慢查询超时，2.4 引入）
- COOKIE_SECURE / TRUSTED_PROXY_COUNT（原先就缺，一并补全）

.env.example

@@ -11,6 +11,19 @@ RATE_LIMIT_UPLOAD_BURST=15
 RATE_LIMIT_IMAGE_PER_SEC=10
 RATE_LIMIT_IMAGE_BURST=50
 
+# Security
+# Trusted origin for CSRF checks on write requests (POST/PUT/PATCH/DELETE).
+# Set to your production origin, e.g. https://your-domain.example.
+# Unset: falls back to the request Host header + X-Forwarded-Proto (behind a reverse proxy).
+APP_BASE_URL=
+# Set true/1/yes to add the Secure flag to the session cookie (enable in HTTPS production).
+COOKIE_SECURE=false
+# Number of reverse proxies in front of the app; used to extract the real client IP
+# from X-Forwarded-For. 0 when serving directly; 1 behind one proxy (e.g. nginx/Caddy).
+TRUSTED_PROXY_COUNT=0
+# Per-query timeout in seconds; slow queries are canceled to protect the connection pool.
+STATEMENT_TIMEOUT_SECS=30
+
 # WebP encoding configuration
 # Quality: 0.0 (smallest) to 100.0 (best), default 85.0
 WEBP_QUALITY=85.0