deploy: support runtime env files

deploy/systemd/README.md

@@ -12,6 +12,7 @@ python3 deploy/systemd/install_systemd.py \
   --user mt2.jakubkadlec.dev \
   --group mt2.jakubkadlec.dev \
   --runtime-root /home/mt2.jakubkadlec.dev/metin/runtime/server \
+  --env-file /etc/metin/metin.env \
   --channel 1 \
   --channel 99 \
   --restart
@@ -30,3 +31,14 @@ python3 deploy/systemd/install_systemd.py \
 - `/usr/local/libexec/metin-wait-port`
 
 The `metin-db-ready.service` gate waits until the DB socket is actually accepting connections before `auth` and `game` units start.
+
+## Optional Environment File
+
+The runtime units support an optional `EnvironmentFile` for host-local overrides:
+
+- default path: `/etc/metin/metin.env`
+- it is loaded with `EnvironmentFile=-...`, so the file may be absent
+- recommended ownership: `root:root`
+- recommended mode: `0600`
+
+This is the preferred place for production-only values such as DB credentials and the admin page password.