chore: keep host/client specifics out of the tree (env & config)

Showroom-safe: the tree no longer carries internal hosts, IPs, ports,
personal names, client domains or client file names. Behaviour is
unchanged and now supplied per deployment.

- catalog: hardcoded mail-org / project classifiers become a YAML-driven
  Classifier (OO_CATALOG_CONFIG or --config); neutral default classifies
  nothing as work. New catalog/classify.go + example + tests.
- storage_fallback: drop the baked-in MinIO endpoint IP; require
  MINIO_ENDPOINT (+ keys) from the env.
- kontolink: build DocEditor links from $ONLYOFFICE_URL instead of a
  hardcoded portal host; kontoblatt: no client file id in the output name.
- oo: load .env CLI-wide (bootstrap.LoadEnv in execute) so
  non-authenticating commands (catalog scans) also see config.
- genericize comments/docs/fixtures (AGENTS, README, .env.example,
  crm-associations, catalog tests, ES/pdfattach tests, mails).

catalog/thunderbird_test.go

@@ -16,8 +16,8 @@ func TestNoisyEmail(t *testing.T) {
 	if !noisyEmail("x@marketplace.amazon.de") {
 		t.Fatal("amazon marketplace")
 	}
-	if noisyEmail("andriy.oblivantsev@wheregroup.com") {
-		t.Fatal("should keep wheregroup")
+	if noisyEmail("alice.smith@acme.example") {
+		t.Fatal("should keep a human work address")
 	}
 }
 
@@ -25,14 +25,15 @@ func TestParseMABEmails(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "abook.mab")
 	body := `// mork junk
-		PrimaryEmail=andriy.oblivantsev@wheregroup.com
+		PrimaryEmail=alice.smith@acme.example
 		noreply@github.com
-		axel.schaefer@wheregroup.com
+		bob.jones@acme.example
 `
 	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	ents, err := parseMABEmails(path)
+	// Neutral default: no deployment rules → unclassified.
+	ents, err := parseMABEmails(path, DefaultClassifier())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -40,7 +41,18 @@ func TestParseMABEmails(t *testing.T) {
 		t.Fatalf("got %d: %+v", len(ents), ents)
 	}
 	for _, e := range ents {
-		if e.Org != "WhereGroup" || e.Role != "work" {
+		if e.Org != "" || e.Role != "unknown" {
+			t.Fatalf("%+v", e)
+		}
+	}
+	// A deployment rule classifies the domain as work.
+	cl := &Classifier{MailOrgs: []MailRule{{Domain: "acme.example", Org: "Acme", Zone: "warm", Role: "work"}}}
+	ents, err = parseMABEmails(path, cl)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, e := range ents {
+		if e.Org != "Acme" || e.Role != "work" || e.Zone != "warm" {
 			t.Fatalf("%+v", e)
 		}
 	}
@@ -56,8 +68,8 @@ func TestParseGlodaContacts(t *testing.T) {
 	_, err = db.Exec(`
 		CREATE TABLE contacts (id INTEGER PRIMARY KEY, name TEXT);
 		CREATE TABLE identities (id INTEGER PRIMARY KEY, contactID INTEGER, kind TEXT, value TEXT);
-		INSERT INTO contacts VALUES (1, 'Axel Schaefer');
-		INSERT INTO identities VALUES (1, 1, 'email', 'axel.schaefer@wheregroup.com');
+		INSERT INTO contacts VALUES (1, 'Alice Smith');
+		INSERT INTO identities VALUES (1, 1, 'email', 'alice.smith@acme.example');
 		INSERT INTO contacts VALUES (2, 'Noise Bot');
 		INSERT INTO identities VALUES (2, 2, 'email', 'noreply@example.com');
 	`)
@@ -66,14 +78,14 @@ func TestParseGlodaContacts(t *testing.T) {
 	}
 	_ = db.Close()
 
-	ents, err := parseGlodaContacts(dbPath)
+	ents, err := parseGlodaContacts(dbPath, DefaultClassifier())
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(ents) != 1 {
 		t.Fatalf("got %d %+v", len(ents), ents)
 	}
-	if ents[0].First != "Axel" || ents[0].Emails[0] != "axel.schaefer@wheregroup.com" {
+	if ents[0].First != "Alice" || ents[0].Emails[0] != "alice.smith@acme.example" {
 		t.Fatalf("%+v", ents[0])
 	}
 }
@@ -84,7 +96,7 @@ func TestScanThunderbirdRoot(t *testing.T) {
 	if err := os.MkdirAll(prof, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(prof, "abook.mab"), []byte("mail=paul.schmidt@wheregroup.com\n"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(prof, "abook.mab"), []byte("mail=paul.schmidt@acme.example\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	doc, err := ScanThunderbirdRoot(root)