normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

openarchiver_dev/sample.env

@@ -14,11 +14,10 @@ SYNC_FREQUENCY='* * * * *'
 # PostgreSQL
 POSTGRES_DB=open_archive
 POSTGRES_USER=admin
-POSTGRES_PASSWORD=password
-DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}"
+POSTGRES_PASSWORD=ChangeThisPassword
 
 # Meilisearch
-MEILI_MASTER_KEY=aSampleMasterKey
+MEILI_MASTER_KEY=ChangeThisPassword
 MEILI_HOST=http://meilisearch:7700
 # The number of emails to batch together for indexing. Defaults to 500.
 MEILI_INDEXING_BATCH=500
@@ -26,7 +25,7 @@ MEILI_INDEXING_BATCH=500
 # Redis (We use Valkey, which is Redis-compatible and open source)
 REDIS_HOST=valkey
 REDIS_PORT=6379
-REDIS_PASSWORD=RedisPasswordChangeMe
+REDIS_PASSWORD=ChangeThisPassword
 # If you run Valkey service from Docker Compose, set the REDIS_TLS_ENABLED variable to false.
 REDIS_TLS_ENABLED=false
 
@@ -52,14 +51,21 @@ RATE_LIMIT_MAX_REQUESTS=100
 
 # JWT
 # IMPORTANT: Change this to a long, random, and secret string in your .env file
-JWT_SECRET=a-very-secret-key-that-you-should-change
+JWT_SECRET=ChangeThisPassword
 JWT_EXPIRES_IN="7d"
 
 # Master Encryption Key for sensitive data (Such as Ingestion source credentials and passwords)
 # IMPORTANT: Generate a secure, random 32-byte hex string for this
 # You can use `openssl rand -hex 32` to generate a key.
-ENCRYPTION_KEY=bbffe1e3ae16ee30e8e4f15b401a46d34582147e14526a0f37f93d4ad5c6cb04
+ENCRYPTION_KEY=ChangeThisPassword
 
 # Apache Tika Integration
 # ONLY active if TIKA_URL is set
 TIKA_URL=http://tika:9998
+MEILISEARCH_IMAGE=getmeili/meilisearch:v1.15
+OPENARCHIVER_IMAGE=logiclabshq/open-archiver:latest
+OPENARCHIVER_PORT=3000
+OPENARCHIVER_RESTART=unless-stopped
+POSTGRES_IMAGE=postgres:17-alpine
+TIKA_IMAGE=apache/tika:3.2.2.0-full
+VALKEY_IMAGE=valkey/valkey:8-alpine