docs: apply the closed Gitea decisions 3, 19, 20 and 38

- Issue 3 (Q4b): the registered-device cookie stays; no device certificate.
- Issue 19 (Q22): upload limits stay; ClamAV stays off in both stacks,
  the workstations run Microsoft Defender.
- Issue 20 (Q23): the storage alert stays at 85 percent; phase 9 mails
  it to PS-Admins.
- Issue 38 (OPS2): the test stack stays under ~/packetstation/test on
  docker-1. test.env.example, the compose header, README, CLAUDE.md,
  DEPLOY.md and SECURITY.md give that path and the actual modes. The
  production layout is asked on issue 38.

All four confirm the built defaults, so no code changed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/env/prod.env.example

@@ -79,7 +79,7 @@ ASSETS_QUOTA_WARN_PCT=85
 # 0 measures the assets volume. A byte count measures the stored files against that many bytes.
 ASSETS_QUOTA_BYTES=0
 
-# ---- ClamAV (optional virus scan of uploads) ----
+# ---- ClamAV (optional virus scan of uploads; left off by IT, Gitea issue 19) ----
 # Empty means no scan. When set, start the stack with --profile clamav on every docker compose command.
 # An unreachable scanner then refuses uploads until it answers.
 #CLAMAV_HOST=packetstation-clamav