Restore credentials in appsettings per owner decision

The committed connection strings, EmailSettings and seed-admin password are
intentional configuration for this project, not a bug. docker-compose no
longer requires env vars; deployment works exactly as before. The seeder
stays config-driven (SeedAdmin block now committed), and env-var overrides
remain available if ever wanted. bug-fixes.md updated to reclassify #15/#16.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -8,11 +8,6 @@ services:
     restart: always
     ports:
       - "5039:80"
-    environment:
-      # Secrets are supplied via the environment (e.g. an untracked .env file),
-      # never committed to the repository.
-      ConnectionStrings__DefaultConnection: ${DB_CONNECTION_STRING:?set DB_CONNECTION_STRING in .env}
-      SeedAdmin__Password: ${SEED_ADMIN_PASSWORD:-}
     networks:
       - caddy_network