docs(env): document the HERMES_WEBUI_* vars the code reads but no template listed

.env.example listed 8 basic vars; the server reads ~30. Add the
operator-facing ones with defaults from the code, grouped into Security,
Reverse-proxy header trust, Uploads & limits, Onboarding, and Advanced
integrations: PASSWORD, PASSKEY, SESSION_TTL, SECURE, COOKIE_NAME,
ALLOWED_ORIGINS, TLS_CERT/KEY, CSP_CONNECT_EXTRA/FRAME_EXTRA,
TRUST_FORWARDED_HOST/FOR/PROTO, ATTACHMENT_DIR, MAX_EXTRACTED_MB,
FOLDER_ZIP_MAX_*, SLOW_REQUEST_SECONDS, SKIP_ONBOARDING, PREFILL_* hooks,
EXTERNAL_NOTES_SOURCES, PLUGINS_DIR, GATEWAY_API_KEY, CLAUDE_PROJECTS_DIR,
CODEX_HOME, WIKI_PATH. The Docker template notes each needs a compose
environment: passthrough to take effect.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.docker.example

@@ -47,6 +47,37 @@ GID=1000
 # the agent.
 # HERMES_WEBUI_PASSWORD=change-me-to-something-strong
 
+# ──────────────────────────────────────────────────────────────────────────
+# Additional security / networking / limit knobs — advanced
+# ──────────────────────────────────────────────────────────────────────────
+# The WebUI process reads more HERMES_WEBUI_* variables than the compose
+# files forward by default. To use any of these in Docker, uncomment it here
+# AND add a matching passthrough line under `environment:` in your compose
+# file (e.g. `- HERMES_WEBUI_SESSION_TTL=${HERMES_WEBUI_SESSION_TTL:-}`).
+# Full descriptions live in .env.example.
+#
+# Auth cookie lifetime in seconds (default 2592000 = 30 days):
+# HERMES_WEBUI_SESSION_TTL=2592000
+#
+# Force the Secure cookie flag when serving HTTPS via a reverse proxy:
+# HERMES_WEBUI_SECURE=1
+#
+# Allowed public origins (scheme required) when behind a reverse proxy:
+# HERMES_WEBUI_ALLOWED_ORIGINS=https://myapp.example.com
+#
+# Trust reverse-proxy forwarded headers (only enable behind a proxy YOU run):
+# HERMES_WEBUI_TRUST_FORWARDED_HOST=1
+# HERMES_WEBUI_TRUST_FORWARDED_FOR=1
+# HERMES_WEBUI_TRUST_FORWARDED_PROTO=1
+#
+# Enable the passkey/WebAuthn login surface (default off):
+# HERMES_WEBUI_PASSKEY=1
+#
+# Archive extraction cap (MB) and "download folder as ZIP" caps:
+# HERMES_WEBUI_MAX_EXTRACTED_MB=2048
+# HERMES_WEBUI_FOLDER_ZIP_MAX_MB=1024
+# HERMES_WEBUI_FOLDER_ZIP_MAX_FILES=50000
+
 # ──────────────────────────────────────────────────────────────────────────
 # Permission handling for bind-mounted .hermes — advanced
 # ──────────────────────────────────────────────────────────────────────────