refactor: move homarr SECRET_ENCRYPTION_KEY to .env

Define HOMARR_SECRET_ENCRYPTION_KEY in .env and reference it from docker-compose.yml instead of hardcoding it inline, keeping all secrets in .env. Resolved value is unchanged (no container recreate); deployed to valhalla and validated with 'dc config homarr'.

.env

@@ -90,6 +90,13 @@ famapp_MINIO_BUCKET=garden
 famapp_OPENPLANTBOOK_CLIENT_ID=5JdQLab69RhVaF4er7b7D29BCrkf3fo3OEiDsOQa
 famapp_OPENPLANTBOOK_CLIENT_SECRET=kxPTrdQPAVta7sjVuIRf5EGIJ1fKvlMlqRSJpQtFxRftJhg7oeGnXzwH7ls6tluQLFUYVDYRMwISiAuKZGZLvkuJzUwFGCwhZw7UtW8OvcTGy4717WeNUinvuCDSsNXP
 
+# =============================================================
+# MANAGEMENT (homarr)
+# =============================================================
+# Homarr config encryption key (moved out of docker-compose.yml so all
+# secrets live in .env). Generate with: openssl rand -hex 32
+HOMARR_SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f
+
 # =============================================================
 # CLOUDFLARE DNS (for Caddy DNS-01 TLS challenge)
 # =============================================================

docker-compose.yml

@@ -623,7 +623,7 @@ services:
     image: ghcr.io/homarr-labs/homarr:latest
     restart: unless-stopped
     environment:
-      - SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f
+      - SECRET_ENCRYPTION_KEY=${HOMARR_SECRET_ENCRYPTION_KEY}
     networks:
       - management
     volumes: