chore: keep host/client specifics out of the tree (env & config)

Showroom-safe: the tree no longer carries internal hosts, IPs, ports,
personal names, client domains or client file names. Behaviour is
unchanged and now supplied per deployment.

- catalog: hardcoded mail-org / project classifiers become a YAML-driven
  Classifier (OO_CATALOG_CONFIG or --config); neutral default classifies
  nothing as work. New catalog/classify.go + example + tests.
- storage_fallback: drop the baked-in MinIO endpoint IP; require
  MINIO_ENDPOINT (+ keys) from the env.
- kontolink: build DocEditor links from $ONLYOFFICE_URL instead of a
  hardcoded portal host; kontoblatt: no client file id in the output name.
- oo: load .env CLI-wide (bootstrap.LoadEnv in execute) so
  non-authenticating commands (catalog scans) also see config.
- genericize comments/docs/fixtures (AGENTS, README, .env.example,
  crm-associations, catalog tests, ES/pdfattach tests, mails).

catalog/classify.example.yaml

@@ -0,0 +1,26 @@
+# Deployment classification rules for `oo catalog scan-projects` /
+# `oo catalog scan-thunderbird`. Point OO_CATALOG_CONFIG (or --config) at a copy
+# of this file. Keep your real rules out of the repository — they name your
+# clients and hosts. The library defaults to no rules (nothing is "work").
+#
+# work_remotes: a git remote containing any of these substrings → work/hot.
+work_remotes:
+  - git.internal.example
+  - github.com/acme
+#
+# work_names: a project directory name containing any of these substrings → work/warm.
+work_names:
+  - acme
+#
+# mail_orgs: ordered rules for Thunderbird/mbox identities; the first match wins.
+# Match by exact `domain`, `suffix` (e.g. ".example.com") and/or display `name`.
+# `zone` defaults to hot, `role` to work.
+mail_orgs:
+  - domain: acme.example
+    org: Acme GmbH
+    zone: hot
+    role: work
+  - suffix: .gov.example
+    org: Public Sector
+    zone: warm
+    role: work