chore: keep host/client specifics out of the tree (env & config)

Showroom-safe: the tree no longer carries internal hosts, IPs, ports,
personal names, client domains or client file names. Behaviour is
unchanged and now supplied per deployment.

- catalog: hardcoded mail-org / project classifiers become a YAML-driven
  Classifier (OO_CATALOG_CONFIG or --config); neutral default classifies
  nothing as work. New catalog/classify.go + example + tests.
- storage_fallback: drop the baked-in MinIO endpoint IP; require
  MINIO_ENDPOINT (+ keys) from the env.
- kontolink: build DocEditor links from $ONLYOFFICE_URL instead of a
  hardcoded portal host; kontoblatt: no client file id in the output name.
- oo: load .env CLI-wide (bootstrap.LoadEnv in execute) so
  non-authenticating commands (catalog scans) also see config.
- genericize comments/docs/fixtures (AGENTS, README, .env.example,
  crm-associations, catalog tests, ES/pdfattach tests, mails).

file_es_text_test.go

@@ -78,7 +78,7 @@ func TestParseESTextResponse(t *testing.T) {
 	      {
 	        "_id": "3578",
 	        "_score": 3.21,
-	        "_source": {"id": "3578", "title": "2026-07-28-S1021-Edelweiss-rechnung.pdf", "folder": "634", "ext": "pdf"},
+	        "_source": {"id": "3578", "title": "2026-07-28-S1021-acme-rechnung.pdf", "folder": "634", "ext": "pdf"},
 	        "highlight": {"content": ["Begleitzettel … <em>S1021</em> …"]}
 	      }
 	    ]
@@ -92,7 +92,7 @@ func TestParseESTextResponse(t *testing.T) {
 		t.Fatalf("hits = %d, want 1", len(hits))
 	}
 	h := hits[0]
-	if h.ID != "3578" || h.Title != "2026-07-28-S1021-Edelweiss-rechnung.pdf" || h.Kind != File {
+	if h.ID != "3578" || h.Title != "2026-07-28-S1021-acme-rechnung.pdf" || h.Kind != File {
 		t.Errorf("entry = %+v", h.Entry)
 	}
 	if h.ParentID != "634" || !reflect.DeepEqual(h.Path, []string{"634"}) {