normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bookstack/compose.yaml

@@ -3,15 +3,15 @@ services:
     image: ${BOOKSTACK_IMAGE:-solidnerd/bookstack:latest}
     restart: ${BOOKSTACK_RESTART:-unless-stopped}
     volumes:
-      - ${VOL_PATH}/bookstack/uploads:/var/www/bookstack/storage/uploads
-      - ${VOL_PATH}/bookstack/public:/var/www/bookstack/public/uploads
+      - ${VOL_PATH:-/data}/bookstack/uploads:/var/www/bookstack/storage/uploads
+      - ${VOL_PATH:-/data}/bookstack/public:/var/www/bookstack/public/uploads
     environment:
-      - APP_KEY=${BOOKSTACK_APP_KEY:-APP_KEY}
+      - APP_KEY=${BOOKSTACK_APP_KEY:-ChangeThisPassword}
       - APP_TIMEZONE=${BOOKSTACK_APP_TIMEZONE:-America/Vancouver}
       - APP_URL=${BOOKSTACK_APP_URL:-http://localhost:8080}
       - DB_DATABASE=${BOOKSTACK_DB_DATABASE:-bookstack}
       - DB_HOST=mariadb:3306
-      - DB_PASSWORD=${BOOKSTACK_DB_PASSWORD:-dbpass}
+      - DB_PASSWORD=${BOOKSTACK_DB_PASSWORD:-ChangeThisPassword}
       - DB_USERNAME=${BOOKSTACK_DB_USERNAME:-dbuser}
       - REVISION_LIMIT=${BOOKSTACK_REVISION_LIMIT:-false}
     ports:
@@ -25,16 +25,16 @@ services:
   mariadb:
     image: ${MARIADB_IMAGE:-mariadb:latest}
     restart: ${MARIADB_RESTART:-unless-stopped}
-    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1 --skip-innodb-read-only-compressed
     volumes:
-      - ${VOL_PATH}/bookstack/db:/var/lib/mysql
+      - ${VOL_PATH:-/data}/bookstack/db:/var/lib/mysql
     environment:
       - MARIADB_DATABASE=${BOOKSTACK_DB_DATABASE:-bookstack}
       - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD:-ChangeThisPassword}
       - MARIADB_USER=${BOOKSTACK_DB_USERNAME:-dbuser}
-      - MARIADB_PASSWORD=${BOOKSTACK_DB_PASSWORD:-AlsoChangeThisPassword}
+      - MARIADB_PASSWORD=${BOOKSTACK_DB_PASSWORD:-ChangeThisPassword}
     networks:
       - internal
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1 --skip-innodb-read-only-compressed
 
 networks:
   proxy:

bookstack/sample.env

@@ -8,10 +8,10 @@ MARIADB_RESTART=unless-stopped
 MARIADB_ROOT_PASSWORD=ChangeThisPassword
 
 # Bookstack
-BOOKSTACK_APP_KEY=APP_KEY
+BOOKSTACK_APP_KEY=ChangeThisPassword
 BOOKSTACK_APP_TIMEZONE=America/Vancouver
 BOOKSTACK_APP_URL=http://localhost:8080
 BOOKSTACK_DB_DATABASE=bookstack
-BOOKSTACK_DB_PASSWORD=dbpass
+BOOKSTACK_DB_PASSWORD=ChangeThisPassword
 BOOKSTACK_DB_USERNAME=dbuser
 BOOKSTACK_REVISION_LIMIT=false