normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vscode/compose.yaml

@@ -6,14 +6,14 @@ services:
     restart: ${VSCODE_RESTART:-unless-stopped}
 
     volumes:
-      - ${VOL_PROJECTS:-/data/projects}:/data
+      - ${VOL_PROJECTS:-${VOL_PATH:-/data}/projects}:/data
       - ${VOL_PATH:-/data}/vscode/config:/config
 
     environment:
       # App-specific
       - PUID=${VSCODE_PUID:-1000}
       - PGID=${VSCODE_PGID:-1000}
-      - PASSWORD=${VSCODE_PASSWORD:-RanDoMChangeMe}
+      - PASSWORD=${VSCODE_PASSWORD:-ChangeThisPassword}
       - DEFAULT_WORKSPACE=${DEFAULT_WORKSPACE:-/data}
       - PROXY_DOMAIN=${VSCODE_DOMAIN:-localhost}
 

vscode/sample.env

@@ -5,7 +5,7 @@ VOL_PROJECTS=/data
 # ===== Code Server =====
 VSCODE_IMAGE=lscr.io/linuxserver/code-server:latest
 VSCODE_RESTART=unless-stopped
-VSCODE_PASSWORD=ChangeThisNow
+VSCODE_PASSWORD=ChangeThisPassword
 VSCODE_PORT=8443
 VSCODE_DOMAIN=localhost
 DEFAULT_WORKSPACE=/data