refactor: pure env_file stack.env convention across all stacks

Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).

- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
  on-host Portainer working-copy path (/config/portainer/compose/<id>)

Validated with docker compose config on valhalla for all 15 stacks.

stacks/foundry/docker-compose.yml

@@ -17,9 +17,6 @@ services:
     env_file:
       - stack.env
     environment:
-      - FOUNDRY_USERNAME=${FOUNDRY_USERNAME}
-      - FOUNDRY_PASSWORD=${FOUNDRY_PASSWORD}
-      - FOUNDRY_ADMIN_KEY=${FOUNDRY_ADMIN_KEY}
       - CONTAINER_VERBOSE=true
       - FOUNDRY_HOSTNAME=foundry.ginnoir.com
       - FOUNDRY_PROXY_PORT=443
@@ -27,7 +24,6 @@ services:
       - CONTAINER_PRESERVE_OWNER=/data/Data/storage
       - FOUNDRY_UID=1000
       - FOUNDRY_GID=1000
-      - CONTAINER_PATCH_URLS=${FOUNDRY_PATCH_URLS:-}
     ports:
       - "30000:30000"
 
@@ -45,9 +41,6 @@ services:
     env_file:
       - stack.env
     environment:
-      - FOUNDRY_USERNAME=${FOUNDRY_USERNAME}
-      - FOUNDRY_PASSWORD=${FOUNDRY_PASSWORD}
-      - FOUNDRY_ADMIN_KEY=${FOUNDRY_ADMIN_KEY}
       - CONTAINER_VERBOSE=true
       - FOUNDRY_HOSTNAME=foundry2.ginnoir.com
       - FOUNDRY_PROXY_PORT=443
@@ -55,7 +48,6 @@ services:
       - CONTAINER_PRESERVE_OWNER=/data/Data/storage
       - FOUNDRY_UID=1000
       - FOUNDRY_GID=1000
-      - CONTAINER_PATCH_URLS=${FOUNDRY_PATCH_URLS:-}
     ports:
       - "30001:30000"
 

stacks/foundry/stack.env

@@ -1,8 +1,9 @@
-# foundry stack secrets
+# foundry stack secrets — injected into both Foundry services via env_file.
+# Var names are exactly what the felddy/foundryvtt container reads.
 FOUNDRY_USERNAME=ginnoir
 FOUNDRY_PASSWORD=agt-UAU!uky_ykh3juy
 FOUNDRY_ADMIN_KEY=fuckyouben
 # NOTE: the old plutonium patch gist 404s (dead URL), which put Foundry into a
 # crash/backoff loop. Disabled to restore service. To re-enable, set this to a
 # CURRENT raw gist URL for the plutonium patch script.
-FOUNDRY_PATCH_URLS=
+CONTAINER_PATCH_URLS=