stacks: add .env + .env.secrets.ctmpl for platform stacks, fix var-name mismatches

Adds real Vault Agent secret templates and non-secret env vars for
14 platform stacks (caddy, caddy-internal, dashy, docker-socket-
proxy, dockhand, gitea, grafana-stack, hawser, kestra, kopia,
mosquitto, nocodb, node-red, speedtest-tracker), sanitized per the
kv/host/... convention established for identity-and-security.

Also fixes 6 variable-name mismatches discovered while cross-checking
every new .env/.ctmpl against what its actual public compose file
references (the public compose files were already adapted from the
private originals during an earlier reorg pass, so names don't always
match 1:1): authentik (PG_USER/PG_DB/PG_PASS), gitea (added
GITEA_DOMAIN/GITEA_ROOT_URL, dropped an unused duplicate-instance pair
of vars), grafana-stack (GRAFANA_ADMIN_PASSWORD), kestra (added
USERNAME/PASSWORD), kopia (SECRET_PASSWORD), nocodb (JWT_SECRET).
Also dropped an unused DOCKER var across most stacks where the
compose file hardcodes its path instead of referencing it.

stacks/identity-and-security/authentik/.env

@@ -3,9 +3,6 @@ AUTHENTIK_URL=https://authentik.local.example.com
 # Exposed HTTP port
 COMPOSE_PORT_HTTP=9000
 
-# Volume Home
-DOCKER=/path/to/docker_volumes
-
 AUTHENTIK_EMAIL__HOST=smtp.example.com
 AUTHENTIK_EMAIL__PORT=587
 AUTHENTIK_EMAIL__USERNAME=[email protected]

stacks/identity-and-security/authentik/.env.secrets.ctmpl

@@ -1,4 +1,3 @@
 AUTHENTIK_SECRET_KEY={{ with secret "kv/host/authentik" }}{{ .Data.data.authentik_secret_key }}{{ end }}
 AUTHENTIK_EMAIL__PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.email_password }}{{ end }}
-POSTGRES_PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }}
-AUTHENTIK_POSTGRESQL__PASSWORD={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }}
+PG_PASS={{ with secret "kv/host/authentik" }}{{ .Data.data.pg_pass }}{{ end }}