refactor: pure env_file stack.env convention across all stacks

Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).

- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
  on-host Portainer working-copy path (/config/portainer/compose/<id>)

Validated with docker compose config on valhalla for all 15 stacks.

stacks/notify/docker-compose.yml

@@ -16,7 +16,6 @@ services:
     env_file:
       - stack.env
     environment:
-      - TZ=${TZ}
       - NTFY_DEFAULT_HOST=https://ntfy.ginnoir.com
       - NTFY_BASE_URL=https://ntfy.ginnoir.com
       - NTFY_CACHE_FILE=/var/lib/ntfy/cache.db
@@ -63,7 +62,6 @@ services:
       - CRON_MIN=3,33
       - TRUSTED_PROXY=172.16.0.1/12 192.168.0.1/16
       - FRESHRSS_INSTALL=--default-user ginnoir --api-enabled --base-url https://freshrss.ginnoir.com
-      - FRESHRSS_USER=--api-password ${FRESHRSS_API_PASSWORD} --email ${FRESHRSS_EMAIL} --password ${FRESHRSS_PASSWORD} --user ginnoir
 
   vigilant:
     container_name: vigilant

stacks/notify/stack.env

@@ -1,5 +1,5 @@
-# notify stack secrets
+# notify stack secrets — injected via env_file; container-exact var names.
 TZ=America/Chicago
-FRESHRSS_API_PASSWORD=d0fet0th3x
-FRESHRSS_PASSWORD=d0fet0th3x
-FRESHRSS_EMAIL=3nigma.matt@gmail.com
+# FreshRSS first-run user bootstrap (the container reads FRESHRSS_USER as the
+# full CLI argument string for its install script).
+FRESHRSS_USER=--api-password d0fet0th3x --email 3nigma.matt@gmail.com --password d0fet0th3x --user ginnoir