normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

invoiceninja_dev/sample.env

@@ -10,7 +10,7 @@ REDIS_IMAGE=redis:alpine
 # IN application vars
 APP_URL=http://localhost:8000
 # echo -n "base64:$(openssl rand -base64 32)"
-APP_KEY=base64:IIEkhdQrjEFFIUAFAZMXBlPBM0mwLb76MC4txj/tu4g= 
+APP_KEY=ChangeThisPassword
 APP_ENV=production
 APP_DEBUG=true
 REQUIRE_HTTPS=false
@@ -34,15 +34,15 @@ DB_HOST=mysql
 DB_PORT=3306
 DB_DATABASE=ninja
 DB_USERNAME=ninja
-DB_PASSWORD=ninja
-DB_ROOT_PASSWORD=ninjaAdm1nPassword
+DB_PASSWORD=ChangeThisPassword
+DB_ROOT_PASSWORD=ChangeThisPassword
 DB_CONNECTION=mysql
 
 
 # Create initial user
 # Default to these values if empty
 IN_USER_EMAIL=admin@example.com
-IN_PASSWORD=changeme!
+IN_PASSWORD=ChangeThisPassword
 # IN_USER_EMAIL=
 # IN_PASSWORD=
 
@@ -56,15 +56,10 @@ MAIL_ENCRYPTION=null
 MAIL_FROM_ADDRESS='user@example.com'
 MAIL_FROM_NAME='Self Hosted User'
 
-# MySQL
-MYSQL_ROOT_PASSWORD=ninjaAdm1nPassword
-MYSQL_USER=ninja
-MYSQL_PASSWORD=ninja
-MYSQL_DATABASE=ninja
 
 # GoCardless/Nordigen API key for banking integration
-NORDIGEN_SECRET_ID=
-NORDIGEN_SECRET_KEY=
+NORDIGEN_SECRET_ID=ChangeThisPassword
+NORDIGEN_SECRET_KEY=ChangeThisPassword
 
 IS_DOCKER=true
 SCOUT_DRIVER=null