refactor: pure env_file stack.env convention across all stacks

Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).

- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
  on-host Portainer working-copy path (/config/portainer/compose/<id>)

Validated with docker compose config on valhalla for all 15 stacks.

stacks/resume/docker-compose.yml

@@ -19,7 +19,6 @@ services:
     environment:
       - POSTGRES_DB=postgres
       - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
       interval: 10s
@@ -39,9 +38,6 @@ services:
       - /storage1/labdata/resume/minio:/data
     env_file:
       - stack.env
-    environment:
-      - MINIO_ROOT_USER=${MINIO_ROOT_USER}
-      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
     healthcheck:
       test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
       interval: 30s
@@ -59,7 +55,6 @@ services:
     environment:
       - TIMEOUT=10000
       - CONCURRENT=10
-      - TOKEN=${CHROME_TOKEN}
       - EXIT_ON_HEALTH_FAILURE=true
       - PRE_REQUEST_HEALTH_CHECK=true
 
@@ -85,16 +80,11 @@ services:
       - APP_URL=https://resume.ginnoir.com
       - STORAGE_URL=https://storage.j-costa.com/default
       - PRINTER_ENDPOINT=http://chrome:3000
-      - PRINTER_TOKEN=${CHROME_TOKEN}
-      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres
-      - AUTH_SECRET=${RESUME_AUTH_SECRET}
       - MAIL_FROM=noreply@localhost
       - STORAGE_ENDPOINT=resume-minio
       - STORAGE_PORT=9000
       - STORAGE_REGION=us-east-1
       - STORAGE_BUCKET=default
-      - STORAGE_ACCESS_KEY=${MINIO_ROOT_USER}
-      - STORAGE_SECRET_KEY=${MINIO_ROOT_PASSWORD}
       - STORAGE_USE_SSL=false
       - STORAGE_SKIP_BUCKET_CHECK=false
 

stacks/resume/stack.env

@@ -1,9 +1,24 @@
-# resume stack secrets
+# resume stack secrets — injected into all services via env_file.
+# Var names are exactly what each container reads (no ${VAR} interpolation).
+# Components are duplicated into composites (DATABASE_URL embeds
+# POSTGRES_PASSWORD; STORAGE_* mirror MINIO_*) — keep them in sync on rotation.
+
+# postgres
 POSTGRES_PASSWORD=postgres
+
+# minio (resume-minio service)
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=minioadmin
-CHROME_TOKEN=chrome_token
-# Auth/JWT signing secret for Reactive Resume (the app reads ${RESUME_AUTH_SECRET}).
+
+# browserless chrome auth token (chrome reads TOKEN, the app reads PRINTER_TOKEN)
+TOKEN=chrome_token
+PRINTER_TOKEN=chrome_token
+
+# reactive-resume app
+DATABASE_URL=postgresql://postgres:postgres@postgres:5432/postgres
+STORAGE_ACCESS_KEY=minioadmin
+STORAGE_SECRET_KEY=minioadmin
+# Auth/JWT signing secret for Reactive Resume.
 # Pinned to the running value so recreating the container keeps sessions valid.
 # Rotate with: openssl rand -hex 64
-RESUME_AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f
+AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f