normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

invoiceninja_dev/compose.yaml

@@ -7,8 +7,8 @@ services:
     environment:
       - MYSQL_DATABASE=${DB_DATABASE:-ninja}
       - MYSQL_USER=${DB_USERNAME:-ninja}
-      - MYSQL_PASSWORD=${DB_PASSWORD:-ninja}
-      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD:-ninjaAdm1nPassword}
+      - MYSQL_PASSWORD=${DB_PASSWORD:-ChangeThisPassword}
+      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD:-ChangeThisPassword}
     networks:
       - internal
 
@@ -24,6 +24,42 @@ services:
     volumes:
       - ${VOL_PATH:-/data}/invoiceninja/public:/var/www/html/public
       - ${VOL_PATH:-/data}/invoiceninja/storage:/var/www/html/storage
+    environment:
+      - APP_URL=${APP_URL:-http://localhost:8000}
+      - APP_KEY=${APP_KEY:-ChangeThisPassword}
+      - APP_ENV=${APP_ENV:-production}
+      - APP_DEBUG=${APP_DEBUG:-false}
+      - REQUIRE_HTTPS=${REQUIRE_HTTPS:-false}
+      - PHANTOMJS_PDF_GENERATION=${PHANTOMJS_PDF_GENERATION:-false}
+      - PDF_GENERATOR=${PDF_GENERATOR:-snappdf}
+      - TRUSTED_PROXIES=${TRUSTED_PROXIES:-*}
+      - CACHE_DRIVER=${CACHE_DRIVER:-redis}
+      - QUEUE_CONNECTION=${QUEUE_CONNECTION:-redis}
+      - SESSION_DRIVER=${SESSION_DRIVER:-redis}
+      - REDIS_HOST=${REDIS_HOST:-redis}
+      - REDIS_PASSWORD=${REDIS_PASSWORD:-null}
+      - REDIS_PORT=${REDIS_PORT:-6379}
+      - FILESYSTEM_DISK=${FILESYSTEM_DISK:-debian_docker}
+      - DB_CONNECTION=${DB_CONNECTION:-mysql}
+      - DB_HOST=${DB_HOST:-mysql}
+      - DB_PORT=${DB_PORT:-3306}
+      - DB_DATABASE=${DB_DATABASE:-ninja}
+      - DB_USERNAME=${DB_USERNAME:-ninja}
+      - DB_PASSWORD=${DB_PASSWORD:-ChangeThisPassword}
+      - IN_USER_EMAIL=${IN_USER_EMAIL:-admin@example.com}
+      - IN_PASSWORD=${IN_PASSWORD:-ChangeThisPassword}
+      - MAIL_MAILER=${MAIL_MAILER:-log}
+      - MAIL_HOST=${MAIL_HOST:-smtp.mailtrap.io}
+      - MAIL_PORT=${MAIL_PORT:-2525}
+      - MAIL_USERNAME=${MAIL_USERNAME:-null}
+      - MAIL_PASSWORD=${MAIL_PASSWORD:-null}
+      - MAIL_ENCRYPTION=${MAIL_ENCRYPTION:-null}
+      - MAIL_FROM_ADDRESS=${MAIL_FROM_ADDRESS:-user@example.com}
+      - MAIL_FROM_NAME=${MAIL_FROM_NAME:-Self Hosted User}
+      - NORDIGEN_SECRET_ID=${NORDIGEN_SECRET_ID:-}
+      - NORDIGEN_SECRET_KEY=${NORDIGEN_SECRET_KEY:-}
+      - IS_DOCKER=${IS_DOCKER:-true}
+      - SCOUT_DRIVER=${SCOUT_DRIVER:-null}
     networks:
       - internal
     depends_on:

invoiceninja_dev/sample.env

@@ -10,7 +10,7 @@ REDIS_IMAGE=redis:alpine
 # IN application vars
 APP_URL=http://localhost:8000
 # echo -n "base64:$(openssl rand -base64 32)"
-APP_KEY=base64:IIEkhdQrjEFFIUAFAZMXBlPBM0mwLb76MC4txj/tu4g= 
+APP_KEY=ChangeThisPassword
 APP_ENV=production
 APP_DEBUG=true
 REQUIRE_HTTPS=false
@@ -34,15 +34,15 @@ DB_HOST=mysql
 DB_PORT=3306
 DB_DATABASE=ninja
 DB_USERNAME=ninja
-DB_PASSWORD=ninja
-DB_ROOT_PASSWORD=ninjaAdm1nPassword
+DB_PASSWORD=ChangeThisPassword
+DB_ROOT_PASSWORD=ChangeThisPassword
 DB_CONNECTION=mysql
 
 
 # Create initial user
 # Default to these values if empty
 IN_USER_EMAIL=admin@example.com
-IN_PASSWORD=changeme!
+IN_PASSWORD=ChangeThisPassword
 # IN_USER_EMAIL=
 # IN_PASSWORD=
 
@@ -56,15 +56,10 @@ MAIL_ENCRYPTION=null
 MAIL_FROM_ADDRESS='user@example.com'
 MAIL_FROM_NAME='Self Hosted User'
 
-# MySQL
-MYSQL_ROOT_PASSWORD=ninjaAdm1nPassword
-MYSQL_USER=ninja
-MYSQL_PASSWORD=ninja
-MYSQL_DATABASE=ninja
 
 # GoCardless/Nordigen API key for banking integration
-NORDIGEN_SECRET_ID=
-NORDIGEN_SECRET_KEY=
+NORDIGEN_SECRET_ID=ChangeThisPassword
+NORDIGEN_SECRET_KEY=ChangeThisPassword
 
 IS_DOCKER=true
 SCOUT_DRIVER=null