normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gitea/compose.yaml

@@ -3,7 +3,7 @@ services:
     image: ${GITEA_IMAGE:-gitea/gitea:latest}
     restart: ${GITEA_RESTART:-always}
     volumes:
-      - ${VOL_PATH}/gitea/data:/data
+      - ${VOL_PATH:-/data}/gitea/data:/data
     environment:
       - USER_UID=1000
       - USER_GID=1000
@@ -11,7 +11,7 @@ services:
       - GITEA__database__HOST=${GITEA_DB_HOST:-gitea-db:3306}
       - GITEA__database__NAME=${GITEA_DB_NAME:-gitea}
       - GITEA__database__USER=${GITEA_DB_USER:-gitea}
-      - GITEA__database__PASSWD=${GITEA_DB_PASS:-changeMe}
+      - GITEA__database__PASSWD=${GITEA_DB_PASS:-ChangeThisPassword}
       - GITEA__server__SSH_DOMAIN=${GITEA_SSH_DOMAIN}
       - GITEA__server__PROTOCOL=http
       - GITEA__server__DOMAIN=${GITEA_DOMAIN:-git.example.com}
@@ -32,11 +32,11 @@ services:
     image: ${MARIADB_IMAGE:-mariadb:latest}
     restart: ${MARIADB_RESTART:-unless-stopped}
     volumes:
-      - ${VOL_PATH}/gitea/db:/var/lib/mysql
+      - ${VOL_PATH:-/data}/gitea/db:/var/lib/mysql
     environment:
-      - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD:-changeMe}
+      - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD:-ChangeThisPassword}
       - MARIADB_USER=${GITEA_DB_USER:-gitea}
-      - MARIADB_PASSWORD=${GITEA_DB_PASS:-changeMe}
+      - MARIADB_PASSWORD=${GITEA_DB_PASS:-ChangeThisPassword}
       - MARIADB_DATABASE=${GITEA_DB_NAME:-gitea}
     networks:
       - internal

gitea/sample.env

@@ -6,11 +6,11 @@ GITEA_PORT=3000
 GITEA_SSH_PORT=22
 MARIADB_IMAGE=mariadb:latest
 MARIADB_RESTART=unless-stopped
-MARIADB_ROOT_PASSWORD=changeMe
+MARIADB_ROOT_PASSWORD=ChangeThisPassword
 
 # Gitea
 GITEA_DB_HOST=gitea-db:3306
-GITEA_DB_PASS=changeMe
+GITEA_DB_PASS=ChangeThisPassword
 GITEA_DB_NAME=gitea
 GITEA_DB_USER=gitea
 GITEA_SSH_DOMAIN=git.example.com