fix(deploy): forward SMTP/OAuth/AI env vars to web container

compose.prod.yml only whitelisted DB/redis/storage/auth/VAPID/Google/
OpenRouter vars in web.environment — Portainer stack env alone doesn't
reach the container unless the compose file declares the ${VAR} ref, so
SMTP_HOST etc were set in Portainer but silently ignored. Add the full
set from .env.example (SMTP, GitHub/Discord/Authentik OAuth + their
NEXT_PUBLIC_*_ENABLED flags, Stripe, remaining AI provider keys).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/DEPLOY.md

@@ -23,9 +23,34 @@ WEB_PORT=3000
 # optional
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+NEXT_PUBLIC_GITHUB_ENABLED=
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+NEXT_PUBLIC_DISCORD_ENABLED=
+AUTHENTIK_CLIENT_ID=
+AUTHENTIK_CLIENT_SECRET=
+AUTHENTIK_BASE_URL=
+NEXT_PUBLIC_AUTHENTIK_ENABLED=
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM=Epicure <noreply@epicure.app>
+STRIPE_WEBHOOK_SECRET=
 OPENROUTER_API_KEY=
+OPENROUTER_DEFAULT_MODEL=
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+OLLAMA_BASE_URL=
 ```
 
+Every var listed here must exist in `docker/compose.prod.yml`'s `web.environment` block to actually
+reach the container — Portainer stack env alone isn't enough, it only fills in `${...}` refs the
+compose file declares.
+
 5. Deploy the stack. Portainer builds `web` from the repo's root `Dockerfile` (see `build:` in compose.prod.yml) — no separate image push needed.
 6. Enable GitOps updates (webhook or polling) on the stack if you want redeploy-on-push.
 

docker/compose.prod.yml

@@ -80,7 +80,28 @@ services:
       VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
       GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
+      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID}
+      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET}
+      NEXT_PUBLIC_GITHUB_ENABLED: ${NEXT_PUBLIC_GITHUB_ENABLED}
+      DISCORD_CLIENT_ID: ${DISCORD_CLIENT_ID}
+      DISCORD_CLIENT_SECRET: ${DISCORD_CLIENT_SECRET}
+      NEXT_PUBLIC_DISCORD_ENABLED: ${NEXT_PUBLIC_DISCORD_ENABLED}
+      AUTHENTIK_CLIENT_ID: ${AUTHENTIK_CLIENT_ID}
+      AUTHENTIK_CLIENT_SECRET: ${AUTHENTIK_CLIENT_SECRET}
+      AUTHENTIK_BASE_URL: ${AUTHENTIK_BASE_URL}
+      NEXT_PUBLIC_AUTHENTIK_ENABLED: ${NEXT_PUBLIC_AUTHENTIK_ENABLED}
+      SMTP_HOST: ${SMTP_HOST}
+      SMTP_PORT: ${SMTP_PORT}
+      SMTP_SECURE: ${SMTP_SECURE}
+      SMTP_USER: ${SMTP_USER}
+      SMTP_PASS: ${SMTP_PASS}
+      SMTP_FROM: ${SMTP_FROM}
+      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
+      OPENROUTER_DEFAULT_MODEL: ${OPENROUTER_DEFAULT_MODEL}
+      OPENAI_API_KEY: ${OPENAI_API_KEY}
+      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
+      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL}
     ports:
       # published on portainer LXC host; traefik (other LXC) routes here via <this-lxc-ip>:${WEB_PORT}
       - "${WEB_PORT:-3000}:3000"