normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

immich_dev/compose.yaml

@@ -12,7 +12,7 @@ services:
     environment:
       - REDIS_HOSTNAME=immich-redis
       - DB_HOSTNAME=immich-postgres
-      - DB_PASSWORD=${IMMICH_DB_PASSWORD:-changeme}
+      - DB_PASSWORD=${IMMICH_DB_PASSWORD:-ChangeThisPassword}
       - DB_USERNAME=${IMMICH_DB_USERNAME:-postgres}
       - DB_DATABASE_NAME=${IMMICH_DB_DATABASE_NAME:-immich}
     ports:
@@ -47,7 +47,7 @@ services:
     volumes:
       - ${VOL_PATH:-/data}/immich/postgres:/var/lib/postgresql/data
     environment:
-      - POSTGRES_PASSWORD=${IMMICH_DB_PASSWORD:-changeme}
+      - POSTGRES_PASSWORD=${IMMICH_DB_PASSWORD:-ChangeThisPassword}
       - POSTGRES_USER=${IMMICH_DB_USERNAME:-postgres}
       - POSTGRES_DB=${IMMICH_DB_DATABASE_NAME:-immich}
       - POSTGRES_INITDB_ARGS=--data-checksums

immich_dev/sample.env

@@ -7,6 +7,6 @@ REDIS_IMAGE=redis:6.2.19-alpine
 POSTGRES_IMAGE=tensorchord/pgvecto-rs:pg14-v0.2.0
 IMMICH_RESTART=unless-stopped
 IMMICH_PORT=8000
-IMMICH_DB_PASSWORD=changeme
+IMMICH_DB_PASSWORD=ChangeThisPassword
 IMMICH_DB_USERNAME=postgres
 IMMICH_DB_DATABASE_NAME=immich