Merge pull request 'Document dotenv 16 quoting rule for .env values' (#11) from feature/api-esm-prep into master

Reviewed-on: #11

.env.example

@@ -1,3 +1,5 @@
+# Values containing #, ", \ or surrounding spaces must be single-quoted
+# (dotenv 16 treats an unquoted # as a comment): DB_PASSWORD='abc#def'
 PORT=3000
 
 DB_HOST=

CLAUDE.md

@@ -47,6 +47,11 @@ Express.js REST API in TypeScript with a service-oriented layering. Domains: `Ca
 
 ## Environment
 
+dotenv 16 parses `.env` stricter than the old dotenv 8: an unquoted `#` starts a comment and
+backslash escapes inside double quotes are expanded. Wrap any value containing `#`, `"`, `\` or
+surrounding spaces in single quotes (`DB_PASSWORD='abc#def'`), which are taken literally.
+A truncated password shows up as MariaDB "Access denied ... (using password: YES)".
+
 Copy `.env.example` (or create `.env`) with:
 ```
 PORT=