Say where the string coercion has to happen

A ConfigMap's data values must be strings and this template cannot enforce it:
kustomize re-serialises before Flux substitutes, stripping quotes and !!str
alike, so a value that looks numeric or boolean parses as one and the apply
fails on the type. The quotes have to be inside the substituted value.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -47,6 +47,7 @@ The namespace must exist first, and so must the AppRole Secret the store reads.
 | `N8N_IMAGE`, `POSTGRES_IMAGE` | pinned images, tag included |
 | `N8N_STORAGE`, `POSTGRES_STORAGE` | claim sizes, e.g. `2Gi`, `5Gi` |
 | `TIMEZONE` | e.g. `Europe/Paris`; drives cron triggers |
+| `EXECUTIONS_MAX_AGE_HOURS`, `BLOCK_ENV_ACCESS` | **quote these inside the value**: `'"336"'`, `'"false"'`. They land in a ConfigMap, whose values must be strings, and the template cannot force it — kustomize strips quotes and `!!str` alike before substitution runs |
 | `INGRESS_CLASS`, `INGRESS_BODY_SIZE` | e.g. `nginx`, `"50m"` |
 | `N8N_WEBHOOK_AUTH_URL` | an endpoint that answers 2xx for an authorised caller and 401/403 otherwise. **Required** — n8n's trigger endpoints carry no authentication of their own, so without this anyone who can reach the host can run any workflow. An OIDC provider's `userinfo` works as-is |
 | `TLS_ISSUER_NAME`, `TLS_ISSUER_KIND` | a cert-manager issuer, e.g. `ClusterIssuer` |