refactor: pure env_file stack.env convention across all stacks

Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).

- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
  on-host Portainer working-copy path (/config/portainer/compose/<id>)

Validated with docker compose config on valhalla for all 15 stacks.

stacks/authentik/docker-compose.yml

@@ -8,7 +8,7 @@
 services:
   authentik-server:
     container_name: authentik_server
-    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2024.12.3}
+    image: ghcr.io/goauthentik/server:2024.12.3
     restart: unless-stopped
     command: server
     networks: [authentik, edge]
@@ -17,10 +17,6 @@ services:
     environment:
       AUTHENTIK_REDIS__HOST: authentik-redis
       AUTHENTIK_POSTGRESQL__HOST: authentik-db
-      AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_DB_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
-      AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_DB_NAME:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
       AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
     ports:
       - "9200:9000"
@@ -32,7 +28,7 @@ services:
 
   authentik-worker:
     container_name: authentik_worker
-    image: ghcr.io/goauthentik/server:${AUTHENTIK_IMAGE_TAG:-2024.12.3}
+    image: ghcr.io/goauthentik/server:2024.12.3
     restart: unless-stopped
     command: worker
     networks: [authentik]
@@ -41,10 +37,6 @@ services:
     environment:
       AUTHENTIK_REDIS__HOST: authentik-redis
       AUTHENTIK_POSTGRESQL__HOST: authentik-db
-      AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_DB_USER:-authentik}
-      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
-      AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_DB_NAME:-authentik}
-      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
       AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
     depends_on:
       authentik-db:
@@ -59,18 +51,10 @@ services:
     networks: [authentik]
     env_file:
       - stack.env
-    environment:
-      POSTGRES_USER: ${AUTHENTIK_DB_USER:-authentik}
-      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASSWORD}
-      POSTGRES_DB: ${AUTHENTIK_DB_NAME:-authentik}
     volumes:
       - /config/authentik/postgres:/var/lib/postgresql/data
     healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "pg_isready -U ${AUTHENTIK_DB_USER:-authentik} -d ${AUTHENTIK_DB_NAME:-authentik}",
-        ]
+      test: ["CMD-SHELL", "pg_isready -U authentik -d authentik"]
       interval: 10s
       timeout: 5s
       retries: 5

stacks/authentik/stack.env

@@ -1,6 +1,11 @@
-# authentik stack secrets
-AUTHENTIK_IMAGE_TAG=2024.12.3
-AUTHENTIK_DB_USER=authentik
-AUTHENTIK_DB_PASSWORD=ebb7d34ecbc4fc8f95cd16ef491d2162cdf8
-AUTHENTIK_DB_NAME=authentik
+# authentik stack secrets — injected into all services via env_file.
+# Var names are exactly what each container reads (no ${VAR} interpolation).
+# AUTHENTIK_POSTGRESQL__* (server/worker) and POSTGRES_* (db) must stay in sync.
+# Image tag is pinned in docker-compose.yml — bump it there via git.
+AUTHENTIK_POSTGRESQL__USER=authentik
+AUTHENTIK_POSTGRESQL__PASSWORD=ebb7d34ecbc4fc8f95cd16ef491d2162cdf8
+AUTHENTIK_POSTGRESQL__NAME=authentik
 AUTHENTIK_SECRET_KEY=C33S/oXOVOLrlLnWGMRYadgH9zfEC7Bm1vHtbczkFxHcTOj9j6io397c/OGb
+POSTGRES_USER=authentik
+POSTGRES_PASSWORD=ebb7d34ecbc4fc8f95cd16ef491d2162cdf8
+POSTGRES_DB=authentik