refactor: pure env_file stack.env convention across all stacks

Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).

- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
  on-host Portainer working-copy path (/config/portainer/compose/<id>)

Validated with docker compose config on valhalla for all 15 stacks.

stacks/owncloud/docker-compose.yml

@@ -19,14 +19,9 @@ services:
     env_file:
       - stack.env
     environment:
-      - OWNCLOUD_DOMAIN=${OWNCLOUD_DOMAIN}
       - OWNCLOUD_DB_TYPE=mysql
       - OWNCLOUD_DB_NAME=owncloud
-      - OWNCLOUD_DB_USERNAME=${OWNCLOUD_DB_USER}
-      - OWNCLOUD_DB_PASSWORD=${OWNCLOUD_DB_PASSWORD}
       - OWNCLOUD_DB_HOST=mariadb
-      - OWNCLOUD_ADMIN_USERNAME=${OWNCLOUD_ADMIN_USER}
-      - OWNCLOUD_ADMIN_PASSWORD=${OWNCLOUD_ADMIN_PASSWORD}
       - OWNCLOUD_MYSQL_UTF8MB4=true
       - OWNCLOUD_REDIS_ENABLED=true
       - OWNCLOUD_REDIS_HOST=redis
@@ -49,13 +44,11 @@ services:
     env_file:
       - stack.env
     environment:
-      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
-      - MYSQL_USER=${OWNCLOUD_DB_USER}
-      - MYSQL_PASSWORD=${OWNCLOUD_DB_PASSWORD}
       - MYSQL_DATABASE=owncloud
     command: ["--max-allowed-packet=128M", "--innodb-log-file-size=64M"]
     healthcheck:
-      test: ["CMD", "mariadb-admin", "ping", "-u", "root", "--password=${MYSQL_ROOT_PASSWORD}"]
+      # $$ defers expansion to container runtime (env_file supplies the value)
+      test: ["CMD-SHELL", "mariadb-admin ping -u root --password=\"$$MYSQL_ROOT_PASSWORD\""]
       interval: 10s
       timeout: 5s
       retries: 5

stacks/owncloud/stack.env

@@ -1,7 +1,11 @@
-# owncloud stack secrets
+# owncloud stack secrets — injected via env_file; container-exact var names.
+# OWNCLOUD_* are read by owncloud/server, MYSQL_* by mariadb (cross-injection
+# of the other service's vars is harmless — both images ignore unknown env).
 OWNCLOUD_DOMAIN=files.ginnoir.com
-OWNCLOUD_DB_USER=ginnoir
+OWNCLOUD_DB_USERNAME=ginnoir
 OWNCLOUD_DB_PASSWORD=d0fet0th3x
-OWNCLOUD_ADMIN_USER=ginnoir
+OWNCLOUD_ADMIN_USERNAME=ginnoir
 OWNCLOUD_ADMIN_PASSWORD=d0fet0th3x
 MYSQL_ROOT_PASSWORD=d0fet0th3x
+MYSQL_USER=ginnoir
+MYSQL_PASSWORD=d0fet0th3x