docs: document the two container config paths (closes #110)

Getting Started now shows the docker run with PIXA_SIGNING_KEY and a
short paragraph: the key comes from that environment variable, and any
other setting is changed by mounting a file over /etc/pixa/config.yml.

Model: opus-4-8

README.md

@@ -20,9 +20,16 @@ make build
 
 # or build and run via Docker
 make docker
-docker run -p 8080:8080 pixad:latest
+docker run -p 8080:8080 -e PIXA_SIGNING_KEY="$(openssl rand -base64 32)" pixad:latest
 ```
 
+A container is configured two ways. The signing key comes from the
+`PIXA_SIGNING_KEY` environment variable, which the baked-in config
+reads; if it is unset the container exits at startup naming the
+variable. Everything else uses built-in defaults, so to change any
+other setting mount your own file over `/etc/pixa/config.yml` (see
+`config.example.yml` for the full set of keys).
+
 ## Rationale
 
 Image-heavy web applications need a fast, caching reverse proxy that