normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

activepieces_dev/compose.yaml

@@ -10,15 +10,15 @@ services:
 
     environment:
       - AP_ENGINE_EXECUTABLE_PATH=dist/packages/engine/main.js
-      - AP_ENCRYPTION_KEY=${AP_ENCRYPTION_KEY:-changeme}
-      - AP_JWT_SECRET=${AP_JWT_SECRET:-changeme}
+      - AP_ENCRYPTION_KEY=${AP_ENCRYPTION_KEY:-ChangeThisPassword}
+      - AP_JWT_SECRET=${AP_JWT_SECRET:-ChangeThisPassword}
       - AP_ENVIRONMENT=prod
       - AP_FRONTEND_URL=http://${ACTIVEPIECES_DOMAIN:-localhost}:${ACTIVEPIECES_PORT:-8080}
       - AP_POSTGRES_DATABASE=activepieces
       - AP_POSTGRES_HOST=postgres
       - AP_POSTGRES_PORT=5432
       - AP_POSTGRES_USERNAME=postgres
-      - AP_POSTGRES_PASSWORD=${AP_POSTGRES_PASSWORD:-changeme}
+      - AP_POSTGRES_PASSWORD=${AP_POSTGRES_PASSWORD:-ChangeThisPassword}
       - AP_EXECUTION_MODE=UNSANDBOXED
       - AP_REDIS_HOST=redis
       - AP_REDIS_PORT=6379
@@ -47,7 +47,7 @@ services:
     environment:
       - POSTGRES_DB=activepieces
       - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=${AP_POSTGRES_PASSWORD:-changeme}
+      - POSTGRES_PASSWORD=${AP_POSTGRES_PASSWORD:-ChangeThisPassword}
 
     networks:
       - internal