docs: document Shopify access scopes in .env.example

Shopify has no wildcard admin scope — every capability is a separate
read_*/write_* scope the app must enumerate in the Dev Dashboard. Spell
out the read scopes this server needs today, the write scopes the planned
write tools would need, and a paste-ready full-admin set with the four
approval-gated scopes called out as excluded.

Also note that the client_credentials grant this server is built around is
specific to Dev Dashboard apps: a store-admin custom app issues a
long-lived shpat_ token instead and would require rewriting the auth
client, so expanding an existing app's scopes is the better path to full
admin on a single store.