Document dotenv 16 quoting rule for .env values

A production password containing '#' was truncated after the dotenv 8 -> 16
bump (unquoted '#' now starts a comment), causing MariaDB access denied.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.env.example

@@ -1,3 +1,5 @@
+# Values containing #, ", \ or surrounding spaces must be single-quoted
+# (dotenv 16 treats an unquoted # as a comment): DB_PASSWORD='abc#def'
 PORT=3000
 
 DB_HOST=

CLAUDE.md

@@ -47,6 +47,11 @@ Express.js REST API in TypeScript with a service-oriented layering. Domains: `Ca
 
 ## Environment
 
+dotenv 16 parses `.env` stricter than the old dotenv 8: an unquoted `#` starts a comment and
+backslash escapes inside double quotes are expanded. Wrap any value containing `#`, `"`, `\` or
+surrounding spaces in single quotes (`DB_PASSWORD='abc#def'`), which are taken literally.
+A truncated password shows up as MariaDB "Access denied ... (using password: YES)".
+
 Copy `.env.example` (or create `.env`) with:
 ```
 PORT=