fix(deploy): pass the whole .env into the container (env_file), not a hardcoded allowlist

fix(deploy): pass the whole .env into the container (env_file), not a hardcoded allowlist

docker-compose.standalone.yml only forwarded a hand-maintained allowlist
of env vars into the gluecron container (DATABASE_URL, ANTHROPIC_API_KEY,
GOOGLE_OAUTH_*). Any env-gated feature whose variable wasn't manually
added here was SILENTLY DEAD even when correctly set in .env — the app
reads process.env, but the value never reached the container.

This bit real features: /settings/deploy-targets shows "SERVER_TARGETS_KEY
not set" (the key can't reach the app), WORKFLOW_SECRETS_KEY (workflow
secrets encryption), and — critically for the in-progress work — every
VAPRON_* deploy-trigger var, so the Gluecron→Vapron deploy could never
have been configured no matter what was in .env.

Fix the whole class at the root: add `env_file: .env` so the entire
.env passes through, and any documented variable works the moment it's
set. The explicit `environment:` block is kept — it still wins for the
pinned literals (PORT, NODE_ENV, GIT_REPOS_PATH, APP_BASE_URL, SSH_PORT)
and documents the load-bearing vars. env_file + environment coexist;
environment takes precedence.

SERVER_TARGETS_KEY itself was generated (openssl rand -hex 32) and set in
the box .env in the same change.