docs: document internal worker, retention, and abuse configuration

.env.example

@@ -8,6 +8,7 @@ APP_BASE_URL=https://xartaudio.example.com
 BETTER_AUTH_SECRET=replace-me
 BETTER_AUTH_BASE_PATH=/api/auth
 BETTER_AUTH_DEV_PASSWORD=replace-me
+INTERNAL_API_TOKEN=replace-me
 
 # Convex
 CONVEX_DEPLOYMENT_URL=https://your-deployment.convex.cloud
@@ -56,3 +57,8 @@ MAX_CHARS_PER_ARTICLE=120000
 WEBHOOK_RPM=120
 AUTH_RPM=30
 ACTION_RPM=60
+
+# Anti-abuse policy
+ABUSE_MAX_JOBS_PER_USER_PER_DAY=0
+ABUSE_COOLDOWN_SEC=0
+ABUSE_DENY_USER_IDS=