fix(compose): pass AUTH_SECRET + OPERATOR_TOKEN_VERSION to web container

The web service container only inherited NODE_ENV/DATABASE_URL/DATA_DIR/
MEDIA_DIR/WEB_PORT, so AUTH_SECRET (set in .env.development) was never
visible inside the container. Login bailed out with 'Server is not
configured for sign-in.' loginAction needs both keys to issue cookies,
and OPERATOR_TOKEN_VERSION defaults to 1 (the env-bump session
invalidator).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.base.yml

@@ -36,6 +36,8 @@ services:
       DATA_DIR: ${DATA_DIR}
       MEDIA_DIR: ${MEDIA_DIR}
       WEB_PORT: ${WEB_PORT}
+      AUTH_SECRET: ${AUTH_SECRET}
+      OPERATOR_TOKEN_VERSION: ${OPERATOR_TOKEN_VERSION:-1}
     networks:
       - cmbot
 

docker-compose.dev.yml

@@ -59,5 +59,7 @@ services:
       DATA_DIR: ${DATA_DIR}
       MEDIA_DIR: ${MEDIA_DIR}
       WEB_PORT: ${WEB_PORT}
+      AUTH_SECRET: ${AUTH_SECRET}
+      OPERATOR_TOKEN_VERSION: ${OPERATOR_TOKEN_VERSION:-1}
     depends_on:
       - tools