Enhance environment variable documentation and configuration

- Updated `.env.example` to include new environment variables for server access logging and security settings, ensuring comprehensive configuration options.
- Revised `docker-entrypoint.sh` to clarify the source of supported environment variables.
- Improved `README.md` to reflect the latest environment variable changes and maintain synchronization with the canonical list in `internal/config/config.go`.
- Added tests to ensure documentation consistency across `.env.example` and `README.md`, preventing future discrepancies.

README.md

@@ -64,7 +64,7 @@ Storage encryption key behavior:
 - On subsequent startups, Scratchbox reuses the same key file from that data directory.
 - Keep `storage.data_dir` persistent; losing or replacing `metadata.key` makes existing scratches unreadable.
 
-Environment variables supported by `scratchbox server --env` (note: when `--env` is used, the variables and their values are printed to stdout on startup for diagnostics, with values of IP allow/trusted lists redacted):
+Environment variables supported by `scratchbox server --env` (note: when `--env` is used, the variables and their values are printed to stdout on startup for diagnostics, with values of IP allow/trusted lists redacted). The canonical list of supported vars is envSuffixes in internal/config/config.go — see the comment there for how to keep this documentation in sync when adding new configuration.
 
 - `SCRATCHBOX_SERVER_LISTEN_ADDR`
 - `SCRATCHBOX_SERVER_READ_HEADER_TIMEOUT`
@@ -97,7 +97,7 @@ Environment variables supported by `scratchbox server --env` (note: when `--env`
 - `SCRATCHBOX_SECURITY_RATE_LIMIT_API_WRITE_BURST`
 - `SCRATCHBOX_SECURITY_HSTS_ENABLED`
 
-Example `.env` for Docker:
+Example `.env` for Docker (must be kept in sync with envSuffixes in internal/config/config.go):
 
 ```dotenv
 # server
@@ -109,6 +109,9 @@ SCRATCHBOX_SERVER_IDLE_TIMEOUT=120s
 SCRATCHBOX_SERVER_SHUTDOWN_TIMEOUT=10s
 SCRATCHBOX_SERVER_MAX_HEADER_BYTES=1048576
 SCRATCHBOX_SERVER_ACCESS_LOG_ENABLED=true
+SCRATCHBOX_SERVER_ACCESS_LOG_FILE_PATH=
+SCRATCHBOX_SERVER_ACCESS_LOG_MAX_SIZE=100MiB
+SCRATCHBOX_SERVER_ACCESS_LOG_MAX_BACKUPS=5
 
 # limits
 SCRATCHBOX_LIMITS_MAX_UPLOAD_SIZE=100MiB
@@ -180,11 +183,13 @@ All configuration is YAML.
 - `read_header_timeout`: maximum time for reading request headers.
   - Must be `> 0`
   - Default: `5s`
-- `read_timeout`: maximum time for reading the full request.
-  - Must be `> 0`
+- `read_timeout`: maximum time for reading the full request (including body).
+  - Must be `>= 0`. `0` disables the deadline (same as Go `http.Server`).
+  - Raise this (or set `0`) when `limits.max_upload_size` is large or clients are slow: a 30s body timeout cannot complete multi-GiB uploads.
   - Default: `30s`
-- `write_timeout`: maximum time allowed for writing the response.
-  - Must be `> 0`
+- `write_timeout`: maximum time allowed for writing the response (also bounds slow request handling after headers are read).
+  - Must be `>= 0`. `0` disables the deadline.
+  - Raise this (or set `0`) for large uploads/downloads; after request headers are read the write deadline covers the rest of the handler.
   - Default: `30s`
 - `idle_timeout`: maximum keep-alive idle time between requests.
   - Must be `> 0`