docs(env): document the two optional off-host backup variables

BACKUP_S3_REGION and BACKUP_RETENTION_DAYS are both on the compose whitelist and
both read by the backup job, but the example file listed neither — so an
operator following it had no way to learn that the region defaults to auto, or
that the retention number is what the bucket's own lifecycle rule has to be set
to, since the worker never deletes an object itself.

.env.production.example

@@ -306,6 +306,20 @@ API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
 # BACKUP_S3_SECRET_KEY=""
 # BACKUP_ENCRYPTION_KEY=""
 
+# The two optional members of the set, both with defaults, so leaving them
+# unset does not disable backups.
+#
+# Region sent with the SigV4 signature. Default "auto", which is what
+# Cloudflare R2 expects; AWS S3 and most MinIO deployments want their real
+# region name here.
+# BACKUP_S3_REGION="auto"
+#
+# How long backup objects are meant to live, in days. Default 30, minimum 1.
+# The worker never deletes an object -- its grant is PutObject, GetObject and
+# AbortMultipartUpload -- so this number is what you set the bucket's own
+# lifecycle rule to. See docs/ops/backup-restore.md.
+# BACKUP_RETENTION_DAYS="30"
+
 
 # -----------------------------------------------------------------------------
 # Audit-trail retention -- optional