fix(vikunja): align compose with known-good live instance (review fixes)

Addresses review findings — all reverting to the live config that worked:

- config.yml mounts at /app/vikunja/config.yml (live path), not /etc/vikunja.
- Remove the vikunja container healthcheck: the image ships no wget/curl, so
  an in-container HTTP check is always unhealthy. Health stays on db
  (pg_isready) + host-side healthcheck.sh (curl). Live had no app healthcheck.
- Secrets injected exclusively via env_file (.env) on BOTH services; dropped
  the ${VAR:?} parse-time interpolation that depended on a .env in cwd. db now
  also has env_file. Non-secret env stays inline.
- Rename .env.example -> env.example to match repo convention (forgejo).

Verified: `docker compose -f services/vikunja/docker-compose.yml config` passes;
services/vikunja/.env is gitignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/vikunja/README.md

@@ -22,7 +22,7 @@ by name so the live data survives cutover:
 ## Configuration
 
 - `config.yml` — committed, **secret-free**. Holds OIDC provider metadata.
-- `.env` — **gitignored**. Copy from `.env.example` and fill with the real
+- `.env` — **gitignored**. Copy from `env.example` and fill with the real
   live values (must be identical to the running instance):
   - `POSTGRES_PASSWORD` / `VIKUNJA_DATABASE_PASSWORD` (same value)
   - `VIKUNJA_SERVICE_JWTSECRET`
@@ -38,7 +38,7 @@ by name so the live data survives cutover:
 ## Cutover checklist
 
 1. `git pull` on PIHA.
-2. Create `services/vikunja/.env` from `.env.example` with the real values.
+2. Create `services/vikunja/.env` from `env.example` with the real values.
 3. Confirm the named volumes exist: `docker volume ls | grep vikunja_vikunja`.
 4. `docker compose -f services/vikunja/docker-compose.yml up -d`.
 5. Verify: `./healthcheck.sh` and a test OIDC login.

services/vikunja/docker-compose.yml

@@ -11,6 +11,9 @@ services:
     # causing OIDC discovery to fail.
     extra_hosts:
       - "forgejo.okit.pl:192.168.31.5"
+    # Secrets are injected exclusively via env_file (.env, resolved relative to
+    # this compose file) so they work regardless of the cwd the deploy runs
+    # from — no parse-time ${} interpolation that depends on a .env in cwd.
     env_file:
       - .env
     environment:
@@ -19,31 +22,26 @@ services:
       - VIKUNJA_DATABASE_PORT=5432
       - VIKUNJA_DATABASE_USER=vikunja
       - VIKUNJA_DATABASE_DATABASE=vikunja
-      - VIKUNJA_DATABASE_PASSWORD=${VIKUNJA_DATABASE_PASSWORD:?set in .env}
       - VIKUNJA_SERVICE_PUBLICURL=https://vikunja.okit.pl
-      - VIKUNJA_SERVICE_JWTSECRET=${VIKUNJA_SERVICE_JWTSECRET:?set in .env}
-      # OIDC client secret injected from .env so config.yml stays secret-free.
-      - VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET=${VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET:?set in .env}
       - TZ=Europe/Warsaw
     volumes:
       - vikunja_files:/app/vikunja/files
-      - ./config.yml:/etc/vikunja/config.yml:ro
+      - ./config.yml:/app/vikunja/config.yml:ro
     ports:
       - "3456:3456"
-    healthcheck:
+    # No container healthcheck: the vikunja image has no wget/curl, so any
-      test: ["CMD", "wget", "-qO-", "http://localhost:3456/api/v1/info"]
+    # in-container HTTP check is always unhealthy. Health is covered by db's
-      interval: 30s
+    # pg_isready + the host-side healthcheck.sh (curl from the host).
-      timeout: 10s
-      retries: 5
 
   db:
     image: postgres:16-alpine
     container_name: vikunja-db
     restart: unless-stopped
+    env_file:
+      - .env
     environment:
       - POSTGRES_USER=vikunja
       - POSTGRES_DB=vikunja
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?set in .env}
       - TZ=Europe/Warsaw
     volumes:
       - vikunja_db:/var/lib/postgresql/data