normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

opencode/compose.yaml

@@ -3,8 +3,8 @@ services:
     image: ${OPENCODE_IMAGE:-ghcr.io/anomalyco/opencode:latest}
     restart: ${OPENCODE_RESTART:-unless-stopped}
     volumes:
-      - ${VOL_PATH}/opencode/config:/config
-      - ${VOL_PROJECTS:-${VOL_PATH}/projects}:/projects
+      - ${VOL_PATH:-/data}/opencode/config:/config
+      - ${VOL_PROJECTS:-${VOL_PATH:-/data}/projects}:/projects
     environment:
       - OPENCODE_PORT=${OPENCODE_PORT:-4096}
       - OPENCODE_HOSTNAME=${OPENCODE_HOSTNAME:-0.0.0.0}
@@ -13,14 +13,14 @@ services:
       - OLLAMA_HOST=${OLLAMA_HOST_URL:-http://localhost:11434}
     ports:
       - ${OPENCODE_PORT:-4096}:4096
+    networks:
+      - proxy
     command:
       - serve
       - --port
       - ${OPENCODE_PORT:-4096}
       - --hostname
       - 0.0.0.0
-    networks:
-      - proxy
 
 networks:
   proxy: