normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

paperless/compose.yaml

@@ -3,7 +3,7 @@ services:
     image: ${REDIS_IMAGE:-redis:8}
     restart: ${REDIS_RESTART:-unless-stopped}
     volumes:
-      - ${VOL_PATH}/paperless/redis:/data
+      - ${VOL_PATH:-/data}/paperless/redis:/data
     networks:
       - internal
 
@@ -11,13 +11,13 @@ services:
     image: ${MARIADB_IMAGE:-mariadb:latest}
     restart: ${MARIADB_RESTART:-unless-stopped}
     volumes:
-      - ${VOL_PATH}/paperless/db:/var/lib/mysql
+      - ${VOL_PATH:-/data}/paperless/db:/var/lib/mysql
     environment:
       - MARIADB_HOST=paperless-db
       - MARIADB_DATABASE=${PAPERLESS_MARIADB_DATABASE:-paperless}
       - MARIADB_USER=${PAPERLESS_MARIADB_USER:-paperless}
-      - MARIADB_PASSWORD=${PAPERLESS_MARIADB_PASSWORD:-paperless}
-      - MARIADB_ROOT_PASSWORD=${PAPERLESS_MARIADB_ROOT_PASSWORD:-paperless}
+      - MARIADB_PASSWORD=${PAPERLESS_MARIADB_PASSWORD:-ChangeThisPassword}
+      - MARIADB_ROOT_PASSWORD=${PAPERLESS_MARIADB_ROOT_PASSWORD:-ChangeThisPassword}
     networks:
       - internal
 
@@ -25,22 +25,22 @@ services:
     image: ${PAPERLESS_IMAGE:-ghcr.io/paperless-ngx/paperless-ngx:latest}
     restart: ${PAPERLESS_RESTART:-unless-stopped}
     volumes:
-      - ${VOL_PATH}/paperless/data:/usr/src/paperless/data
-      - ${VOL_PATH}/paperless/media:/usr/src/paperless/media
-      - ${VOL_PATH}/paperless/export:/usr/src/paperless/export
-      - ${VOL_PATH}/paperless/consume:/usr/src/paperless/consume
+      - ${VOL_PATH:-/data}/paperless/data:/usr/src/paperless/data
+      - ${VOL_PATH:-/data}/paperless/media:/usr/src/paperless/media
+      - ${VOL_PATH:-/data}/paperless/export:/usr/src/paperless/export
+      - ${VOL_PATH:-/data}/paperless/consume:/usr/src/paperless/consume
     environment:
       - PAPERLESS_REDIS=redis://paperless-broker:6379
       - PAPERLESS_DBENGINE=mariadb
       - PAPERLESS_DBHOST=paperless-db
       - PAPERLESS_DBUSER=${PAPERLESS_MARIADB_USER:-paperless}
-      - PAPERLESS_DBPASS=${PAPERLESS_MARIADB_PASSWORD:-paperless}
+      - PAPERLESS_DBPASS=${PAPERLESS_MARIADB_PASSWORD:-ChangeThisPassword}
       - PAPERLESS_DBPORT=3306
       - PAPERLESS_TIKA_ENABLED=1
       - PAPERLESS_TIKA_GOTENBERG_ENDPOINT=http://paperless-gotenberg:3000
       - PAPERLESS_TIKA_ENDPOINT=http://paperless-tika:9998
       - PAPERLESS_TIME_ZONE=${TZ:-America/Vancouver}
-      - PAPERLESS_SECRET_KEY=${PAPERLESS_SECRET_KEY:-changeme}
+      - PAPERLESS_SECRET_KEY=${PAPERLESS_SECRET_KEY:-ChangeThisPassword}
       - PAPERLESS_OCR_LANGUAGE=${PAPERLESS_OCR_LANGUAGE:-eng}
       - PAPERLESS_URL=${PAPERLESS_URL:-http://localhost}
       - PAPERLESS_CONSUMER_DELETE_DUPLICATES=${PAPERLESS_CONSUMER_DELETE_DUPLICATES:-0}
@@ -54,12 +54,12 @@ services:
   paperless-gotenberg:
     image: ${GOTENBERG_IMAGE:-gotenberg/gotenberg:8.25}
     restart: ${GOTENBERG_RESTART:-unless-stopped}
+    networks:
+      - internal
     command:
       - gotenberg
       - --chromium-disable-javascript=true
       - --chromium-allow-list=file:///tmp/.*
-    networks:
-      - internal
 
   paperless-tika:
     image: ${TIKA_IMAGE:-apache/tika:latest}