refactor: pure env_file stack.env convention across all stacks

Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).

- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
  on-host Portainer working-copy path (/config/portainer/compose/<id>)

Validated with docker compose config on valhalla for all 15 stacks.

stacks/remote/docker-compose.yml

@@ -8,6 +8,8 @@ services:
     image: rustdesk/rustdesk-server:latest
     command: hbbr
     restart: unless-stopped
+    env_file:
+      - stack.env
     ports:
       - "21117:21117"
     volumes:
@@ -18,6 +20,8 @@ services:
     image: rustdesk/rustdesk-server:latest
     command: hbbs
     restart: unless-stopped
+    env_file:
+      - stack.env
     ports:
       - "21115:21115"
       - "21116:21116"

stacks/remote/stack.env

@@ -0,0 +1,4 @@
+# remote stack config — injected into hbbr/hbbs via env_file.
+# No secrets today: the RustDesk key pair lives in /config/rustdesk/*/data on
+# the host, not in env. Present for stack convention (every stack ships a
+# stack.env). Candidate vars if ever needed: ALWAYS_USE_RELAY, RUST_LOG.