fix: restore docker-compose env-var pattern, fix .env conflict from shell env

docker-compose.yml now reads ADMIN_PASSWORD/JWT_SECRET from env or
.env file; the shell had stale ADMIN_PASSWORD=changeme123 which
overrode .env — document this for future runs.

docker-compose.yml

@@ -10,9 +10,10 @@ services:
     volumes:
       - ./data:/app/data
     environment:
-      - ADMIN_EMAIL=${ADMIN_EMAIL:-admin@smartup.local}
+      - ADMIN_EMAIL=admin@smartup.local
       - ADMIN_PASSWORD=${ADMIN_PASSWORD:?ADMIN_PASSWORD is required}
-      - JWT_SECRET=${JWT_SECRET:-change-me-in-production}
+      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required}
+      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:8899,http://127.0.0.1:8899}
       - DATABASE_URL=sqlite:////app/data/app.db
       - TZ=${TZ:-Asia/Shanghai}
       - UNHEALTHY_THRESHOLD=${UNHEALTHY_THRESHOLD:-3}