docs: add Google Wallet setup guide and loyalty env vars

Step 25 in Hetzner docs with full Google Cloud/Wallet Console setup,
service account configuration, local testing, and architecture diagrams.
Loyalty module env vars added to environment.md and .env.example.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -203,6 +203,34 @@ R2_PUBLIC_URL=
 # Cloudflare R2 backup bucket (used by scripts/backup.sh --upload)
 R2_BACKUP_BUCKET=orion-backups
 
+# =============================================================================
+# LOYALTY MODULE
+# =============================================================================
+# Anti-fraud defaults (all optional, shown values are defaults)
+# LOYALTY_DEFAULT_COOLDOWN_MINUTES=15
+# LOYALTY_MAX_DAILY_STAMPS=5
+# LOYALTY_PIN_MAX_FAILED_ATTEMPTS=5
+# LOYALTY_PIN_LOCKOUT_MINUTES=30
+
+# Points configuration
+# LOYALTY_DEFAULT_POINTS_PER_EURO=10
+
+# Google Wallet integration
+# See docs/deployment/hetzner-server-setup.md Step 25 for setup guide
+# Get Issuer ID from https://pay.google.com/business/console
+# LOYALTY_GOOGLE_ISSUER_ID=3388000000012345678
+# LOYALTY_GOOGLE_SERVICE_ACCOUNT_JSON=/path/to/service-account.json
+
+# Apple Wallet integration (requires Apple Developer account)
+# LOYALTY_APPLE_PASS_TYPE_ID=pass.com.example.loyalty
+# LOYALTY_APPLE_TEAM_ID=ABCD1234
+# LOYALTY_APPLE_WWDR_CERT_PATH=/path/to/wwdr.pem
+# LOYALTY_APPLE_SIGNER_CERT_PATH=/path/to/signer.pem
+# LOYALTY_APPLE_SIGNER_KEY_PATH=/path/to/signer.key
+
+# QR code size in pixels (default: 300)
+# LOYALTY_QR_CODE_SIZE=300
+
 # =============================================================================
 # CLOUDFLARE CDN / PROXY
 # =============================================================================