fix(docs): repair the escaped apostrophes, and document this module's env vars

Nineteen `#swagger` descriptions carried a `\'` inside a single-quoted string.
That is correct JavaScript and wrong here: swagger-autogen does not evaluate the
annotation as JS, so the backslash survives into the spec and Swagger UI renders
"the shard\'s published ruleset" to a reader. Replaced with a typographic
apostrophe, which the same files already use elsewhere.

Found by opening /api/docs in a browser against a real core with this module
installed — the fragment was valid JSON, the paths were right, every test passed,
and it was still wrong on screen. Nothing that reads the artifact can see this;
only reading the rendered page can.

Also documents the four environment variables this module reads
(UOLINK_BASE_URL / _WS_URL / _PROTOCOL, TOWNCRIER_DURATION_SEC). Core's
.env.example is dropping them in the paired website PR: they were never core's,
and a half-copy in two repos goes stale silently.

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -155,6 +155,22 @@ second thing to get right.
 The tarball is assembled from an **include** list, never an exclude list — an exclude list ships
 whatever it forgot. Tests, scripts, `client/src` and the dev dependencies are not in it.
 
+## Environment variables
+
+Four, all optional, all read by this module rather than by core — which is why they are documented
+here and not in core's `.env.example`. In Docker they go in the Compose `.env`, since that is what
+reaches the container.
+
+| Var | Default | What |
+|---|---|---|
+| `UOLINK_BASE_URL` | — | Default sidecar base URL for a site with nothing saved yet. The admin panel's stored value wins. |
+| `UOLINK_WS_URL` | — | Same, for the WebSocket URL. |
+| `UOLINK_PROTOCOL` | `3` | Wire protocol this build speaks. Again only a fallback — set it lower only if you deliberately run an older sidecar. |
+| `TOWNCRIER_DURATION_SEC` | `3600` | How long a published news post's in-game town-crier message stays up (≤ `86400`). |
+
+**The sidecar's auth token is deliberately not here.** It is entered in Admin → Shard, encrypted at
+rest with core's `SECRET_ENC_KEY`, and write-only in the API — never returned to any client.
+
 ## Compatibility
 
 `module.json` declares a `coreApi` semver range, checked at boot against core's `MODULE_API_VERSION`.