chore: keep host/client specifics out of the tree (env & config)

Showroom-safe: the tree no longer carries internal hosts, IPs, ports,
personal names, client domains or client file names. Behaviour is
unchanged and now supplied per deployment.

- catalog: hardcoded mail-org / project classifiers become a YAML-driven
  Classifier (OO_CATALOG_CONFIG or --config); neutral default classifies
  nothing as work. New catalog/classify.go + example + tests.
- storage_fallback: drop the baked-in MinIO endpoint IP; require
  MINIO_ENDPOINT (+ keys) from the env.
- kontolink: build DocEditor links from $ONLYOFFICE_URL instead of a
  hardcoded portal host; kontoblatt: no client file id in the output name.
- oo: load .env CLI-wide (bootstrap.LoadEnv in execute) so
  non-authenticating commands (catalog scans) also see config.
- genericize comments/docs/fixtures (AGENTS, README, .env.example,
  crm-associations, catalog tests, ES/pdfattach tests, mails).

catalog/thunderbird.go

@@ -64,7 +64,7 @@ func noisyEmail(email string) bool {
 	return false
 }
 
-func parseMABEmails(path string) ([]Entry, error) {
+func parseMABEmails(path string, cl *Classifier) ([]Entry, error) {
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err
@@ -76,7 +76,7 @@ func parseMABEmails(path string) ([]Entry, error) {
 		if noisyEmail(em) {
 			continue
 		}
-		org, zone, role := classifyMailIdentity("", em)
+		org, zone, role := cl.ClassifyMail("", em)
 		out = append(out, Entry{
 			ID:      EntryID("person", em, ""),
 			Kind:    "person",
@@ -93,7 +93,7 @@ func parseMABEmails(path string) ([]Entry, error) {
 	return out, nil
 }
 
-func parseGlodaContacts(dbPath string) ([]Entry, error) {
+func parseGlodaContacts(dbPath string, cl *Classifier) ([]Entry, error) {
 	// read-only URI; immutable=1 helps when WAL/shm are missing
 	dsn := "file:" + dbPath + "?mode=ro&_pragma=query_only(1)"
 	db, err := sql.Open("sqlite", dsn)
@@ -137,7 +137,7 @@ func parseGlodaContacts(dbPath string) ([]Entry, error) {
 		if display != "" {
 			first, last = SplitDisplayName(display)
 		}
-		org, zone, role := classifyMailIdentity(display, em)
+		org, zone, role := cl.ClassifyMail(display, em)
 		out = append(out, Entry{
 			ID:      EntryID("person", em, display),
 			Kind:    "person",
@@ -157,25 +157,6 @@ func parseGlodaContacts(dbPath string) ([]Entry, error) {
 	return out, rows.Err()
 }
 
-func classifyMailIdentity(name, email string) (org, zone, role string) {
-	em := NormalizeEmail(email)
-	_, domain, _ := strings.Cut(em, "@")
-	switch {
-	case domain == "wheregroup.com" || strings.Contains(strings.ToLower(name), "wheregroup"):
-		return "WhereGroup", "warm", "work"
-	case domain == "produktor.io" || domain == "eslider.de" || strings.HasSuffix(domain, ".produktor.io"):
-		return "produktor.io", "hot", "work"
-	case domain == "dyvenia.com":
-		return "Dyvenia", "warm", "work"
-	case domain == "immowelt.de" || domain == "immowelt.com":
-		return "Immowelt", "warm", "work"
-	case strings.HasSuffix(domain, ".de") && looksPublicSector(domain):
-		return domain, "warm", "work"
-	default:
-		return "", "private", "unknown"
-	}
-}
-
 func looksPublicSector(domain string) bool {
 	d := strings.ToLower(domain)
 	hints := []string{