docs: OXICLOUD_ENABLE_VIDEO_THUMBNAILS + bundled-binary design record

Documents OXICLOUD_ENABLE_VIDEO_THUMBNAILS (+ OXICLOUD_FFMPEG_PATH) in
example.env and docs/config/env.md — closes the discoverability gap
where the env var was only visible in Rust docstrings.

Also lands docs/plan/bundled-binary.md — the design record referenced
from code comments in src/cli/mod.rs, src/interfaces/web/embedded.rs,
and the Dockerfile.

example.env

@@ -382,6 +382,30 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/oxicloud
 # Enable music playlists and audio metadata (default: true)
 #OXICLOUD_ENABLE_MUSIC=true
 
+# ── Video thumbnails ─────────────────────────────────────────────────────
+# Server-side extraction of a single frame from uploaded videos, encoded
+# as WebP for the thumbnail grid.
+#
+# Runtime dependency: `ffmpeg` on PATH (override with OXICLOUD_FFMPEG_PATH).
+# When ffmpeg is missing at boot AND this flag is true, the server emits a
+# WARN log line ("ffmpeg not found") and falls back to no-thumbnail — the
+# API still works, videos just get a placeholder icon.
+#
+# Turn this off when:
+#   - You can't install ffmpeg on this host (locked-down image, minimal
+#     distro, etc.) and want to silence the boot warning.
+#   - Your client uploads video previews itself (some mobile / desktop
+#     clients generate thumbnails locally and POST them alongside the
+#     upload — the server accepts pre-generated thumbnails via the
+#     upload API and stores them as regular content).
+#
+# Default: true (extracts server-side when ffmpeg is available).
+#OXICLOUD_ENABLE_VIDEO_THUMBNAILS=true
+# Explicit path to ffmpeg. Only useful when ffmpeg isn't on PATH or you
+# want to pin a specific build (e.g. a static portable ffmpeg). Ignored
+# when OXICLOUD_ENABLE_VIDEO_THUMBNAILS=false.
+#OXICLOUD_FFMPEG_PATH=/usr/bin/ffmpeg
+
 # Expose other OxiCloud users as a read-only "system" address book
 # at GET /api/address-books (default: true)
 # Set to false to prevent users from browsing the user directory.