normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

nextcloud/compose.yaml

@@ -2,13 +2,8 @@ services:
   nextcloud-db:
     image: ${MARIADB_IMAGE:-mariadb:latest}
     restart: ${MARIADB_RESTART:-unless-stopped}
-    command: >
-      --transaction-isolation=READ-COMMITTED
-      --binlog-format=ROW
-      --innodb-file-per-table=1
-      --skip-innodb-read-only-compressed
     volumes:
-      - ${VOL_PATH}/nextcloud/db:/var/lib/mysql
+      - ${VOL_PATH:-/data}/nextcloud/db:/var/lib/mysql
     environment:
       - MARIADB_DATABASE=${NEXTCLOUD_DB:-nextcloud}
       - MARIADB_ROOT_PASSWORD=${MARIADB_ROOT_PASSWORD:-ChangeThisPassword}
@@ -16,12 +11,17 @@ services:
       - MARIADB_PASSWORD=${NEXTCLOUD_DB_PASSWORD:-ChangeThisPassword}
     networks:
       - internal
+    command: >
+      --transaction-isolation=READ-COMMITTED
+      --binlog-format=ROW
+      --innodb-file-per-table=1
+      --skip-innodb-read-only-compressed
 
   nextcloud:
     image: ${NEXTCLOUD_IMAGE:-nextcloud:latest}
     restart: ${NEXTCLOUD_RESTART:-unless-stopped}
     volumes:
-      - ${VOL_PATH}/nextcloud/data:/var/www/html
+      - ${VOL_PATH:-/data}/nextcloud/data:/var/www/html
     environment:
       - MYSQL_PASSWORD=${NEXTCLOUD_DB_PASSWORD:-ChangeThisPassword}
       - MYSQL_DATABASE=${NEXTCLOUD_DB:-nextcloud}