refactor: pure env_file stack.env convention across all stacks

Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).

- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
  on-host Portainer working-copy path (/config/portainer/compose/<id>)

Validated with docker compose config on valhalla for all 15 stacks.

stacks/media/docker-compose.yml

@@ -2,6 +2,11 @@
 # All config/data is bind-mounted to /config and /storage1 already (no named
 # volumes to migrate). Services join the private `media` net for inter-app
 # traffic (prowlarr<->sonarr/radarr) and `edge` so Caddy can proxy them.
+#
+# Env convention: every service gets stack.env via env_file; var names there are
+# exactly what the containers read (PUID/PGID/TZ), so no ${VAR} interpolation
+# and no Portainer UI env vars are needed. Service-specific settings stay in
+# per-service environment blocks.
 
 services:
   deluge:
@@ -11,13 +16,9 @@ services:
     networks: [media, edge]
     env_file:
       - stack.env
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
     volumes:
-      - ${ROOT}/storage1/torrents:/downloads
-      - ${ROOT}/config/deluge:/config
+      - /storage1/torrents:/downloads
+      - /config/deluge:/config
     ports:
       - "8112:8112"
 
@@ -28,13 +29,9 @@ services:
     networks: [media, edge]
     env_file:
       - stack.env
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
     volumes:
-      - ${ROOT}/storage1/complete:/downloads
-      - ${ROOT}/config/nzbget:/config
+      - /storage1/complete:/downloads
+      - /config/nzbget:/config
     ports:
       - "6789:6789"
 
@@ -45,16 +42,12 @@ services:
     networks: [media, edge]
     env_file:
       - stack.env
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
     volumes:
       - /etc/localtime:/etc/localtime:ro
-      - ${ROOT}/config/sonarr:/config
-      - ${ROOT}/storage1/Media/TV:/tv
-      - ${ROOT}/storage1/Media/Anime:/anime
-      - ${ROOT}/storage1/complete:/downloads
+      - /config/sonarr:/config
+      - /storage1/Media/TV:/tv
+      - /storage1/Media/Anime:/anime
+      - /storage1/complete:/downloads
     ports:
       - "8989:8989"
 
@@ -65,15 +58,11 @@ services:
     networks: [media, edge]
     env_file:
       - stack.env
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
     volumes:
       - /etc/localtime:/etc/localtime:ro
-      - ${ROOT}/config/radarr:/config
-      - ${ROOT}/storage1/Media/Movies:/movies
-      - ${ROOT}/storage1/complete:/downloads
+      - /config/radarr:/config
+      - /storage1/Media/Movies:/movies
+      - /storage1/complete:/downloads
     ports:
       - "7878:7878"
 
@@ -85,15 +74,12 @@ services:
     env_file:
       - stack.env
     environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
       - UMASK_SET=022
     volumes:
-      - ${ROOT}/config/bazarr:/config
-      - ${ROOT}/storage1/Media/Movies:/movies
-      - ${ROOT}/storage1/Media/TV:/tv
-      - ${ROOT}/storage1/Media/Anime:/anime
+      - /config/bazarr:/config
+      - /storage1/Media/Movies:/movies
+      - /storage1/Media/TV:/tv
+      - /storage1/Media/Anime:/anime
     ports:
       - "6767:6767"
 
@@ -105,10 +91,7 @@ services:
     env_file:
       - stack.env
     environment:
-      - PUID=1000
-      - PGID=1000
       - UMASK=002
-      - TZ=${TZ}
     volumes:
       - /config/prowlarr:/config
     ports:
@@ -122,10 +105,7 @@ services:
     env_file:
       - stack.env
     environment:
-      - PUID=1000
-      - PGID=1000
       - UMASK=002
-      - TZ=${TZ}
     volumes:
       - /config/overseerr:/app/config
     ports:
@@ -138,13 +118,9 @@ services:
     networks: [media, edge]
     env_file:
       - stack.env
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
     volumes:
-      - ${ROOT}/config/tautulli:/config
-      - ${ROOT}/storage1/PMS:/logs
+      - /config/tautulli:/config
+      - /storage1/PMS:/logs
     ports:
       - "8181:8181"
 
@@ -156,9 +132,6 @@ services:
     env_file:
       - stack.env
     environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=${TZ}
       - WEBUI_PORT=3232
       - TORRENTING_PORT=6881
     volumes:
@@ -177,10 +150,7 @@ services:
     env_file:
       - stack.env
     environment:
-      - PUID=1000
-      - PGID=1000
       - UMASK=002
-      - TZ=${TZ}
       - WEBUI_PORTS=6969/tcp
     volumes:
       - /config/whisparr:/config
@@ -201,8 +171,6 @@ services:
     env_file:
       - stack.env
     environment:
-      - PUID=1000
-      - PGID=1000
       - STASH_STASH=/data/
       - STASH_GENERATED=/generated/
       - STASH_METADATA=/metadata/

stacks/media/stack.env

@@ -1,5 +1,6 @@
-# media stack config
+# media stack config — injected into every service via env_file.
+# Var names are exactly what the containers read; no ${VAR} interpolation,
+# no Portainer UI env vars needed.
 TZ=America/Chicago
 PUID=1000
 PGID=1000
-ROOT=/