update .env.example with correct ports and missing vars

[maxmalkin]

Summary

• Fix database ports to match docker-compose (5434/5435, not 5432/5433)
• Add approval UI variables (REGISTRY_URL, PORT)
• Set PORT default to 3001 to avoid conflict with Grafana on 3000
• Replace hardcoded dev passwords with CHANGE_ME placeholders
• Add inline comments documenting which docker-compose ports map where
• Add KMS_BACKEND usage guidance (vault_transit for local, aws/gcp for prod)