refactor(docker): replace env_file with explicit environment variables

- Remove env_file references from docker-compose.yml and docker-compose.prod.yml
- Add explicit environment variable forwarding for all services
- Use TRAEFIK_NETWORK env var in docker-compose.traefik.yml instead of hardcoded name
- Add VITE_* frontend variables to .env.example and deploy/.env.example
- Add missing production variables (TRAEFIK_ENTRYPOINT, TRAEFIK_CERT_RESOLVER) to deploy/.env.example

This makes environment configuration more explicit and easier to manage
across different deployment scenarios (local dev, CI/CD, Portainer).

docker-compose.prod.yml

@@ -41,11 +41,18 @@ services:
     build:
       context: ./apps/api
       dockerfile: Dockerfile
-    env_file:
-      - .env
     environment:
       - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
       - ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
+      - TOOL_DOMAIN=${TOOL_DOMAIN:-tools.localhost}
+      - API_URL=${API_URL:-http://localhost:8000}
+      - WEB_URL=${WEB_URL:-http://localhost:5173}
+      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
+      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
+      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
+      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-change-me-in-production}
+      - ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES:-60}
     depends_on:
       db:
         condition: service_healthy
@@ -72,8 +79,10 @@ services:
     build:
       context: ./apps/web
       dockerfile: Dockerfile
-    env_file:
-      - apps/web/.env
+    environment:
+      - VITE_API_URL=${VITE_API_URL:-http://localhost:8000}
+      - VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER}
+      - VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID}
     depends_on:
       - api
     networks: