Move dev env file to repo root

Use the conventional .env / .env.example location at the repo
root instead of cfg/dev.env / cfg/dev.env.example. .env is what
contributors expect, keeps cfg/ a pure generated-config directory,
and shares the same file if we ever add another dev target that
needs the same overrides.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

.env.example

@@ -0,0 +1,102 @@
+# Dev overrides for `make dev-config`.
+#
+# Copy this file to .env and uncomment any variable you want to
+# override. .env is gitignored; this .env.example is the canonical
+# list of overridable knobs.
+#
+# This is NOT a Docker-compose `.env` file. The Makefile sources it as
+# a POSIX shell snippet (`. ./.env`), so:
+#   - `KEY=value` works and is auto-exported.
+#   - Quote values containing spaces: `KEY="foo bar"`.
+#   - `#` starts a comment, `export KEY=value` is accepted.
+#   - Malformed assignments (e.g. unquoted spaces) abort `make dev-config`.
+#
+# See pkg/bootstrap/builder.go for the full env-var surface; the values
+# set below in the Makefile's `cfg/dev.yaml` recipe are the dev defaults
+# that this file can override.
+
+# ── Base URL & ports ──────────────────────────────────────────────────
+# PROBOD_BASE_URL=http://localhost:8080
+# API_ADDR=:8080
+# API_CORS_ALLOWED_ORIGINS=http://localhost:8080,http://localhost:5173,http://localhost:5174
+# TRUST_CENTER_HTTP_ADDR=:80
+# TRUST_CENTER_HTTPS_ADDR=:443
+
+# ── Observability ─────────────────────────────────────────────────────
+# METRICS_ADDR=localhost:8081
+# TRACING_ADDR=localhost:4317
+
+# ── Secrets (rotate before prod) ──────────────────────────────────────
+# PROBOD_ENCRYPTION_KEY=thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+# AUTH_COOKIE_SECRET=this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes
+# AUTH_PASSWORD_PEPPER=this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes
+
+# ── Cookie ────────────────────────────────────────────────────────────
+# AUTH_COOKIE_DOMAIN=localhost
+# AUTH_COOKIE_SECURE=false
+# AUTH_COOKIE_DURATION=24
+
+# ── Postgres ──────────────────────────────────────────────────────────
+# PG_ADDR=localhost:5432
+# PG_USERNAME=postgres
+# PG_PASSWORD=postgres
+# PG_DATABASE=probod
+# PG_POOL_SIZE=100
+# PG_DEBUG=false
+
+# ── Object storage (SeaweedFS via compose) ────────────────────────────
+# AWS_REGION=us-east-1
+# AWS_BUCKET=probod
+# AWS_ACCESS_KEY_ID=probod
+# AWS_SECRET_ACCESS_KEY=thisisnotasecret
+# AWS_ENDPOINT=http://127.0.0.1:8333
+
+# ── Mailer (Mailpit via compose) ──────────────────────────────────────
+# SMTP_ADDR=localhost:1025
+# SMTP_USER=
+# SMTP_PASSWORD=
+# SMTP_TLS_REQUIRED=false
+# MAILER_SENDER_EMAIL=no-reply@notification.getprobo.com
+# MAILER_SENDER_NAME=Probo
+
+# ── LLM providers ─────────────────────────────────────────────────────
+# OPENAI_API_KEY=sk-...
+# ANTHROPIC_API_KEY=sk-ant-...
+# LLM_DEFAULT_PROVIDER=openai
+# LLM_DEFAULT_MODEL_NAME=gpt-4o
+
+# ── LLM-backed workers (inherit from LLM defaults when unset) ─────────
+# PROBO_AGENT_PROVIDER=anthropic
+# PROBO_AGENT_MODEL_NAME=claude-sonnet-4-6
+# EVIDENCE_DESCRIBER_PROVIDER=openai
+# EVIDENCE_DESCRIBER_MODEL_NAME=gpt-4o-mini
+
+# ── OIDC sign-in providers ────────────────────────────────────────────
+# AUTH_GOOGLE_CLIENT_ID=
+# AUTH_GOOGLE_CLIENT_SECRET=
+# AUTH_MICROSOFT_CLIENT_ID=
+# AUTH_MICROSOFT_CLIENT_SECRET=
+
+# ── Connectors (set _CLIENT_ID to enable; _CLIENT_SECRET is required) ─
+# CONNECTOR_SLACK_CLIENT_ID=
+# CONNECTOR_SLACK_CLIENT_SECRET=
+# CONNECTOR_SLACK_SIGNING_SECRET=
+# CONNECTOR_HUBSPOT_CLIENT_ID=
+# CONNECTOR_HUBSPOT_CLIENT_SECRET=
+# CONNECTOR_GITHUB_CLIENT_ID=
+# CONNECTOR_GITHUB_CLIENT_SECRET=
+# CONNECTOR_NOTION_CLIENT_ID=
+# CONNECTOR_NOTION_CLIENT_SECRET=
+# CONNECTOR_SENTRY_CLIENT_ID=
+# CONNECTOR_SENTRY_CLIENT_SECRET=
+# CONNECTOR_INTERCOM_CLIENT_ID=
+# CONNECTOR_INTERCOM_CLIENT_SECRET=
+# CONNECTOR_DOCUSIGN_CLIENT_ID=
+# CONNECTOR_DOCUSIGN_CLIENT_SECRET=
+# CONNECTOR_BREX_CLIENT_ID=
+# CONNECTOR_BREX_CLIENT_SECRET=
+
+# ── Custom domains (Pebble ACME via compose) ──────────────────────────
+# CUSTOM_DOMAINS_CNAME_TARGET=custom.getprobo.com
+# ACME_DIRECTORY=https://localhost:14000/dir
+# ACME_EMAIL=admin@getprobo.com