docs(env): sync .env.self-host.example with missing variables

Brings the self-hosting template into parity with apps/api/.env.example and the
env vars wiki. Adds (mostly commented for visibility without changing default
behaviour):

- NODE_ENV, DATABASE_URL, DIRECT_DATABASE_URL, REDIS_URL, PORT
  (Docker auto-configures these via DB_PASSWORD; the lines document overrides)
- Stripe billing block (STRIPE_SK, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_*,
  STRIPE_METER_EVENT_NAME)
- Attachments (MAX_ATTACHMENT_SIZE_MB, MAX_ATTACHMENTS_COUNT)
- SMTP_ENABLED in the SMTP Server block
- VERIFY_EMAIL_ON_SIGNUP in User Management
- Phishing Detection block (OPENROUTER_*, PHISHING_*)

Each was either present in apps/api/.env.example or documented in the wiki but
missing from the production template, forcing self-hosters to read source or
the wiki to discover them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.self-host.example

@@ -8,6 +8,15 @@
 DB_PASSWORD=changeme123
 JWT_SECRET=
 
+# The variables below are auto-configured by Docker Compose using DB_PASSWORD
+# above. Override only when pointing at an external database / Redis or when
+# running the app outside of the bundled Compose stack.
+# NODE_ENV=production
+# DATABASE_URL=postgresql://plunk:${DB_PASSWORD}@postgres:5432/plunk
+# DIRECT_DATABASE_URL=postgresql://plunk:${DB_PASSWORD}@postgres:5432/plunk
+# REDIS_URL=redis://redis:6379
+# PORT=8080
+
 # ========================================
 # REQUIRED: Domains
 # ========================================
@@ -67,6 +76,16 @@ GITHUB_OAUTH_SECRET=
 GOOGLE_OAUTH_CLIENT=
 GOOGLE_OAUTH_SECRET=
 
+# ========================================
+# OPTIONAL: Stripe (Billing)
+# ========================================
+# Enables paid billing. All variables must be set together for billing to activate.
+STRIPE_SK=
+STRIPE_WEBHOOK_SECRET=
+STRIPE_PRICE_ONBOARDING=
+STRIPE_PRICE_EMAIL_USAGE=
+STRIPE_METER_EVENT_NAME=emails
+
 # ========================================
 # OPTIONAL: File Storage (Minio)
 # ========================================
@@ -87,6 +106,14 @@ S3_BUCKET=uploads
 S3_PUBLIC_URL=http://localhost:9000/uploads
 S3_FORCE_PATH_STYLE=true
 
+# ========================================
+# OPTIONAL: Attachments
+# ========================================
+# Limits applied to attachments on transactional emails.
+# AWS SES caps total message size at 40 MB; the defaults below leave headroom.
+# MAX_ATTACHMENT_SIZE_MB=10
+# MAX_ATTACHMENTS_COUNT=10
+
 # ========================================
 # OPTIONAL: Notifications (ntfy.sh)
 # ========================================
@@ -117,6 +144,11 @@ NTFY_URL=http://ntfy/plunk-notifications
 # Optional if using PEM files
 SMTP_DOMAIN=smtp.example.com
 
+# Explicitly enable SMTP features in the UI. Automatically enabled when
+# SMTP_DOMAIN is set to a non-localhost value in production.
+# Default: false
+# SMTP_ENABLED=false
+
 # SMTP Ports (defaults work for most setups)
 # PORT_SECURE=465         # SMTPS (implicit TLS)
 # PORT_SUBMISSION=587     # SMTP Submission (STARTTLS)
@@ -152,6 +184,25 @@ SMTP_DOMAIN=smtp.example.com
 # Default: false
 # DISABLE_SIGNUPS=false
 
+# When enabled (true), validates emails on signup — checks for disposable
+# domains, plus-addressing, domain existence, and MX records.
+# Default: false
+# VERIFY_EMAIL_ON_SIGNUP=false
+
+# ========================================
+# OPTIONAL: Phishing Detection
+# ========================================
+# Plunk can use an LLM (via OpenRouter) to detect phishing emails before sending.
+# When enabled, a random sample of outgoing emails is analyzed and projects can
+# be auto-disabled if confidence exceeds the threshold or the cumulative count
+# is reached within the window.
+# OPENROUTER_API_KEY=
+# OPENROUTER_MODEL=anthropic/claude-3-haiku
+# PHISHING_DETECTION_SAMPLE_RATE=0.1
+# PHISHING_CONFIDENCE_THRESHOLD=95
+# PHISHING_CUMULATIVE_THRESHOLD=3
+# PHISHING_CUMULATIVE_WINDOW_MS=3600000
+
 # ========================================
 # OPTIONAL: SES Sending Rate
 # ========================================