chore: keep host/client specifics out of the tree (env & config)

Showroom-safe: the tree no longer carries internal hosts, IPs, ports,
personal names, client domains or client file names. Behaviour is
unchanged and now supplied per deployment.

- catalog: hardcoded mail-org / project classifiers become a YAML-driven
  Classifier (OO_CATALOG_CONFIG or --config); neutral default classifies
  nothing as work. New catalog/classify.go + example + tests.
- storage_fallback: drop the baked-in MinIO endpoint IP; require
  MINIO_ENDPOINT (+ keys) from the env.
- kontolink: build DocEditor links from $ONLYOFFICE_URL instead of a
  hardcoded portal host; kontoblatt: no client file id in the output name.
- oo: load .env CLI-wide (bootstrap.LoadEnv in execute) so
  non-authenticating commands (catalog scans) also see config.
- genericize comments/docs/fixtures (AGENTS, README, .env.example,
  crm-associations, catalog tests, ES/pdfattach tests, mails).

README.md

@@ -743,7 +743,7 @@ opens a shared cooldown gate and `Retry-After` is honoured (see `DoRetry` and
 ooscan 659                             # recursive index → TSV: file_id, folder_id, path, title
 ooscan 659 666 > oo-index.tsv          # several roots into one index
 pdfamount 671                          # "Zu zahlender Betrag" per PDF → TSV: file_id, title, amount
-kontoblatt 3906 ./kontoblatt.xlsx      # summary (Gegenkonto/Monat) uploaded next to source
+kontoblatt 1234 ./kontoblatt.xlsx      # summary (Gegenkonto/Monat) uploaded next to source
 kontolink IN.xlsx oo-index.tsv OUT.xlsx [FILE_ID] [AMOUNTS_TSV]
 # kontolink writes DocEditor links into the Link column: Beleg → supplier+month
 # → amount+date (5th arg = pdfamount output); with FILE_ID it updates the