build: add per-environment (test/prod) Makefile targets

Split env config into local vs remote:
- .env: local/shared config, always loaded (docker compose + make test)
- .env.test / .env.prod: full remote config, loaded on demand via ENV

Remote targets now generate -test/-prod variants (e.g. remote-install-prod);
a guard-env prerequisite blocks bare remote targets with no environment set.
Refresh .env.example to document the two-tier layout and add .env.prod/.env.test
to gitignore and the never-read list in CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -1,27 +1,67 @@
-# SSH connection
-REMOTE_USER=root
+# .env.example — template for the project's environment files.
+#
+# There are TWO kinds of env file, loaded by the Makefile in this order:
+#
+#   .env        → LOCAL / shared config. ALWAYS loaded. NO remote credentials.
+#                 Used by local targets (docker compose ${UID}/${GID} + the
+#                 travel-memories env_file, and `make test-post` / `make test`).
+#                 Copy the LOCAL section below into it.
+#
+#   .env.test   → REMOTE config for the test environment.
+#   .env.prod   → REMOTE config for production.
+#                 Loaded only when a remote target sets ENV, e.g.
+#                 `make remote-install-prod`. Copy the REMOTE section below into
+#                 each, with the values for that environment.
+#
+# .env, .env.test and .env.prod are all gitignored — never commit real values.
+# This .example file is the only one that IS committed; keep its values as
+# placeholders.
+
+# ─────────────────────────────────────────────────────────────────────────────
+# LOCAL  →  copy into  .env
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Host user/group id for container file ownership (docker-compose ${UID}:${GID}).
+# Match your local user: run `id -u` / `id -g` (usually 1000 on a single-user box).
+UID=1000
+GID=1000
+
+# Local Grav dev server + test login, used by `make test-post` / `make test`
+# (scripts/test-post.sh). Must be a valid Grav site login on the local instance.
+GRAV_BASE_URL=http://localhost:8081
+GRAV_TEST_USER=your-local-grav-user
+GRAV_TEST_PASS=your-local-grav-password
+GRAV_USER_DIR=/absolute/path/to/travel-blog-intotheeast/user
+
+# travel-memories service (docker-compose `env_file: .env`). Fill in whatever
+# that Flask app needs — e.g. its Immich connection. Leave commented until set.
+# IMMICH_URL=
+# IMMICH_API_KEY=
+
+# ─────────────────────────────────────────────────────────────────────────────
+# REMOTE  →  copy into  .env.test  AND  .env.prod  (with per-env values)
+# ─────────────────────────────────────────────────────────────────────────────
+
+# SSH connection to the target server.
+REMOTE_USER=deploy
 REMOTE_HOST=example.com
 REMOTE_PORT=22
 REMOTE_HOME=/home/example.com
 
-# Server paths (override here if your setup differs from the Makefile defaults)
+# Server paths. Optional — default to $(REMOTE_HOME)/public_html and
+# $(REMOTE_HOME)/site-config. Set explicitly only if the layout differs
+# (e.g. a per-domain webroot like /home/deploy/domains/test.example.com/public_html).
 WEBROOT=/home/example.com/public_html
 SITE_CONFIG_DIR=/home/example.com/site-config
 
-# Grav
+# Grav version installed by scripts/server-install.sh (remote-install).
 GRAV_VERSION=2.0.0-rc.10
 
-# Repos
+# Repos cloned/pulled on the server.
 USER_REPO=https://gitea.example.com/org/intotheeast-user.git
 MAIN_REPO=https://gitea.example.com/org/travel-blog-intotheeast.git
 
-# Gitea credentials — never commit these; only ever in .env (local) or ~/.env-project (server, temporary)
+# Gitea credentials used by remote-install / remote-env-setup.
 GITEA_HOST=gitea.example.com
 GITEA_USER=deploy-user
 GITEA_TOKEN=your-gitea-personal-access-token
-
-# Test credentials — used by 'make test-post' (must be a valid Grav site login user)
-GRAV_TEST_USER=mischa
-GRAV_TEST_PASS=TravelBlog2026!
-GRAV_BASE_URL=http://localhost:8081
-GRAV_USER_DIR=/home/mischa/Projects/travel-blog-intotheeast/user