Fase 1b: cableado del matcher (ingesta polling, runner shadow/full, comparador)

- config: bloque matcher (MATCHER_MODE off/shadow/full, IRON_PASSWORD, audiencia,
  poll, batch) + validacion
- db: colecciones subscriptions/activefires/notifications_shadow/matcher_state +
  ensureMatcherIndexes (2dsphere en notifications_shadow para el dedupe 500m)
- matcher/context: MatchContext sobre Mongo real (candidatas geo $near 1000km +
  audiencia; dedupe geo $near 500m; lang del owner)
- matcher/ingest: polling de activefires por createdAt>checkpoint (Mongo 3.2 sin
  change streams), checkpoint persistido en matcher_state
- matcher/runner: loop shadow(->notifications_shadow)/full(->notifications),
  idempotente por dedupe+checkpoint
- matcher/compare: comparador de shadow (shadowOnly=spam, realOnly=faltantes,
  contentMismatches) — el gate antes del cutover
- index: arranca el matcher; fake-repo ampliado (upsert, sort, $gt/$lt)
- docs/env/README actualizados

73 tests en verde, typecheck y build OK.

.env.example

@@ -40,6 +40,13 @@ MAIL_URL=smtps://USER:PASS@smtp.host:465
 MAIL_FROM=Todos contra el Fuego <no-reply@comunes.org>
 # MAIL_REDIRECT_TO=buzon-de-test@example.com   # canary/staging: redirige todo el email aquí
 
+# --- Matcher geoespacial (fase 1b: genera notifications a partir de activefires) ---
+MATCHER_MODE=off             # off | shadow | full
+IRON_PASSWORD=               # SECRETO: Meteor.settings.private.ironPassword (para sellar notification.sealed)
+MATCHER_AUDIENCE=web,mobile  # tipos de suscripción que generan notifs aquí (telegram es fase 1c)
+MATCHER_POLL_MS=30000        # cada cuánto sondea activefires (Mongo 3.2, sin change streams)
+MATCHER_BATCH=2000           # máx fuegos por ciclo
+
 # --- Enlaces / mapas ---
 ROOT_URL=https://fuegos.comunes.org/
 GMAPS_KEY=                   # Meteor.settings.gmaps.key