refactor(deploy): merge the three compose files into a base plus overlays

The dev and prod stacks each declared the same nine services, which is how the
S3 credentials and the gateway configuration ended up diverging. compose.yml
now holds every service with no published port and no domain in it, and the
overlays only add what is specific: host ports and pgAdmin for development,
the nginx edge and the mounted secrets for production. The applications sit
behind the `apps` profile, so a plain `up` still starts infrastructure only.

Everything environment-specific moves to the env files: the public URLs, the
credentials and the environment name. The SeaweedFS identity file is rendered
inside the container from S3_ACCESS_KEY and S3_SECRET_KEY, so the store and
the applications can no longer be given different keys.

deploy/.env.example

@@ -1,40 +1,61 @@
-# Dev stack config (deploy/docker-compose.yml).
-# Copy to deploy/.env and adjust. .env is not versioned (.gitignore ignores *.env).
+# Development configuration for deploy/compose.yml + compose.dev.yml.
+# Copy to deploy/.env (up.ps1 does it for you) and adjust. Not versioned.
 
-# PostgreSQL (shared by Musify and Zitadel). Local apps use localhost:59000.
+DOTNET_ENVIRONMENT=Development
+
+# --- Public URLs -------------------------------------------------------------
+# How each service is reached from *outside* Docker. `host.docker.internal`
+# resolves to the same address from the browser, from apps running on the host
+# and from inside the containers, which is what makes the OIDC issuer and the
+# presigned S3 URLs valid in both run modes.
+PUBLIC_WEB_URL=http://localhost:3000
+PUBLIC_API_URL=http://localhost:5111
+PUBLIC_STREAM_URL=http://localhost:8081
+PUBLIC_AUTH_URL=http://host.docker.internal:8080
+
+# --- PostgreSQL (shared by Musify and Zitadel) -------------------------------
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres
 POSTGRES_DB=musify_db
 POSTGRES_HOST_PORT=59000
 
-# pgAdmin (Postgres UI). http://localhost:5050
-PGADMIN_DEFAULT_EMAIL=admin@musify.dev
-PGADMIN_DEFAULT_PASSWORD=admin
-PGADMIN_HOST_PORT=5050
-
-# RabbitMQ (MassTransit)
-RABBITMQ_DEFAULT_USER=guest
-RABBITMQ_DEFAULT_PASS=guest
-
-# Zitadel (OIDC). The masterkey MUST be exactly 32 characters.
+# --- Zitadel (OIDC) ----------------------------------------------------------
+# The masterkey MUST be exactly 32 characters. The external domain/port form
+# the token issuer, so they have to match PUBLIC_AUTH_URL. Changing them needs
+# a re-init: ./up.ps1 -Destroy; ./up.ps1
 ZITADEL_MASTERKEY=MasterkeyNeedsToHave32Characters
-# The external domain/port forms the token issuer and must match everywhere.
-# host.docker.internal resolves the same from browser, local apps and containers,
-# so auth works both locally and full-docker. Changing it needs a re-init
-# (up.ps1 -Destroy; up.ps1). Admin login: <user>@zitadel.<domain>.
 ZITADEL_EXTERNAL_DOMAIN=host.docker.internal
 ZITADEL_EXTERNAL_PORT=8080
+ZITADEL_EXTERNAL_SECURE=false
+ZITADEL_DATABASE_PASSWORD=zitadel
+# Console login: <username>@zitadel.<external domain>
 ZITADEL_ADMIN_USERNAME=admin
 ZITADEL_ADMIN_PASSWORD=Password1!
 
-# SeaweedFS (S3). Must match deploy/seaweedfs/s3.conf.
+# OIDC clients, filled in by deploy/zitadel/provision.ps1.
+AUTH_CLIENT_ID=
+WEB_CLIENT_ID=
+WEB_CLIENT_SECRET=
+
+# --- RabbitMQ (MassTransit) --------------------------------------------------
+RABBITMQ_DEFAULT_USER=guest
+RABBITMQ_DEFAULT_PASS=guest
+
+# --- SeaweedFS (S3) ----------------------------------------------------------
 S3_ACCESS_KEY=admin_access_key
 S3_SECRET_KEY=admin_secret_key
 S3_BUCKET=webapi-storage
+S3_PUBLIC_URL=http://host.docker.internal:8333
+S3_USE_HTTP=true
 
-# Host paths used by up.ps1 and the apps overlay.
-STREAM_KEYS_DIR=D:/weed
-WORKER_TEMP_DIR=D:/tempsFilesDev
+# --- Web player --------------------------------------------------------------
+# Key material for the encrypted session cookie: any long random string.
+SESSION_SECRET=dev-session-secret-change-me-0123456789abcdef
+# Allows the plain-HTTP Zitadel issuer in a production Node build (dev only).
+AUTH_ALLOW_INSECURE_HTTP=true
 
-# OIDC ClientId, filled in by zitadel/provision.ps1 (used by the docker path).
-AUTH_CLIENT_ID=
+# --- Misc --------------------------------------------------------------------
+AUTH_REQUIRE_HTTPS=false
+PGADMIN_DEFAULT_EMAIL=admin@musify.dev
+PGADMIN_DEFAULT_PASSWORD=admin
+PGADMIN_HOST_PORT=5050