normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

rocketchat_dev/compose.yaml

@@ -33,13 +33,19 @@ services:
       - ${VOL_PATH:-/data}/rocketchat_dev/db:/data/db
       - ${VOL_PATH:-/data}/rocketchat_dev/dump:/dump
 
+    networks:
+      - internal
+
     command: mongod --smallfiles --oplogSize 128 --replSet rs0 --storageEngine=mmapv1
 
+  mongo-init-replica:
+    image: ${MONGO_IMAGE:-mongo:4.0}
+
     networks:
       - internal
 
-  mongo-init-replica:
-    image: ${MONGO_IMAGE:-mongo:4.0}
+    depends_on:
+      - mongo
 
     command: >
       mongo mongo/rocketchat --eval
@@ -48,12 +54,6 @@ services:
           members: [ { _id: 0, host: 'localhost:27017' } ]
         })"
 
-    networks:
-      - internal
-
-    depends_on:
-      - mongo
-
   hubot:
     image: ${HUBOT_IMAGE:-rocketchat/hubot-rocketchat:latest}
     restart: ${ROCKETCHAT_RESTART:-unless-stopped}