docs: API token issued+verified — ask 1 answered [#727]

.env.example refs updated (issued 2026-09-02), questions-v1 #1 marked
answered. Material value lives only in ~/.creds/cloudron.env (0600).
Meat: https://projects.knownelement.com/issues/727#note-3928

questions-v1.md

@@ -11,10 +11,12 @@ panel API token exists. A token lets the agent use the Cloudron API (apps,
 configs, backups) instead of shell — cleaner audit trail, and the path for
 future AWX/Ansible modules.
 
-- [ ] Create an API token (panel: my.knownelement.com → your profile → API
+- [x] Create an API token (panel: my.knownelement.com → your profile → API
       access, or `cloudron token create` via CLI) with read scope at minimum
-- [ ] Drop the material value in `~/.creds/cloudron.env` as
+      — received 2026-09-02
+- [x] Drop the material value in `~/.creds/cloudron.env` as
       `CLOUDRON_API_TOKEN=<token>` (never in this repo)
+      — stored 0600; verified: profile → mrcharles, apps list → 200
 
 ## 2. docker daemon.json bounce window (see README "Ground truth")