Correct stale deploy docs and document the new env knobs

deploy/README.md described a rewrites() block that no longer exists, and told
the reader to verify the image bucket's anonymous-download policy was set -
which is precisely the exposure that was closed. Following it would have
re-opened every stored image to the public internet.

Replaced with what is actually true: /minio-images is a session-gated route
handler with per-user key-prefix ownership, the bucket must have no anonymous
policy, and MinIO must stay bound to loopback. Also noted that the suggested
`mc anonymous get` check does not work on this host - the alias has no
credentials and returns Access Denied either way - and gave an external curl
that actually tells you something.

The same stale rationale sat in deploy.sh's build comment. Building without the
env file is still right, just for a different reason: nothing needs baking in.

Added the MCP and OAuth journal greps, an unauthenticated discovery check, and
a note that a 307 there means /.well-known fell out of PUBLIC_ROUTES. Documented
in .env.example that NEXTAUTH_URL must be the exact public origin with no
trailing slash, since it is now the OAuth issuer and MCP resource identifier,
plus the MCP_CHATGPT_TOOLS opt-out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1Ee4Mc1X1SX8HgYa52zu7

.env.example

@@ -5,6 +5,9 @@ POSTGRES_PASSWORD="YOUR_PASSWORD"
 POSTGRES_DB="drinktracker"
 
 # NextAuth
+# Must be the exact public origin, with NO trailing slash. Beyond login redirects
+# it is the OAuth `issuer` and the MCP `resource` identifier, and connectors
+# compare both byte-for-byte - a mismatch fails discovery with no useful error.
 NEXTAUTH_URL="http://localhost:3000"
 NEXTAUTH_SECRET="generate-with: openssl rand -base64 32"
 AUTH_TRUST_HOST="true"  # Set to true when behind a reverse proxy
@@ -25,3 +28,9 @@ ENCRYPTION_KEY="generate-with: openssl rand -hex 32"
 # OpenAI-compatible router that picks the best model per request. LAN-only, plain HTTP.
 # Each user adds their own gateway API key in Settings; this is only the endpoint.
 SWITCHBOARD_BASE_URL="http://192.168.2.11:8787/v1"
+
+# MCP server (optional)
+# The `search` and `fetch` tools exist only for ChatGPT's deep-research mode.
+# Their generic names can muddy tool selection when several connectors are
+# attached at once, so set this to 0 on a Claude-only deployment to drop them.
+# MCP_CHATGPT_TOOLS="0"