stacks: add .env + .env.secrets.ctmpl for platform stacks, fix var-name mismatches

Adds real Vault Agent secret templates and non-secret env vars for
14 platform stacks (caddy, caddy-internal, dashy, docker-socket-
proxy, dockhand, gitea, grafana-stack, hawser, kestra, kopia,
mosquitto, nocodb, node-red, speedtest-tracker), sanitized per the
kv/host/... convention established for identity-and-security.

Also fixes 6 variable-name mismatches discovered while cross-checking
every new .env/.ctmpl against what its actual public compose file
references (the public compose files were already adapted from the
private originals during an earlier reorg pass, so names don't always
match 1:1): authentik (PG_USER/PG_DB/PG_PASS), gitea (added
GITEA_DOMAIN/GITEA_ROOT_URL, dropped an unused duplicate-instance pair
of vars), grafana-stack (GRAFANA_ADMIN_PASSWORD), kestra (added
USERNAME/PASSWORD), kopia (SECRET_PASSWORD), nocodb (JWT_SECRET).
Also dropped an unused DOCKER var across most stacks where the
compose file hardcodes its path instead of referencing it.

stacks/platform/grafana-stack/.env

@@ -0,0 +1,14 @@
+# Exposed HTTP_PORT_prometheus
+HTTP_PORT_prometheus=9796
+
+# Exposed HTTP_PORT_grafana
+HTTP_PORT_grafana=3693
+
+# Exposed HTTP_PORT_loki
+HTTP_PORT_loki=3100
+
+GF_AUTH_GENERIC_OAUTH_CLIENT_ID=example-oauth-client-id
+# GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET — see .env.secrets (Vault)
+AUTHENTIK_URL=https://authentik.caddy.example.com
+GRAFANA_URL=https://grafana.local.example.com
+# GRAFANA_ADMIN_PASSWORD — see .env.secrets (Vault)

stacks/platform/grafana-stack/.env.secrets.ctmpl

@@ -0,0 +1,2 @@
+GRAFANA_ADMIN_PASSWORD={{ with secret "kv/host/grafana-stack" }}{{ .Data.data.admin_password | replaceAll "$" "$$" }}{{ end }}
+GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET={{ with secret "kv/host/grafana-stack" }}{{ .Data.data.oauth_client_secret | replaceAll "$" "$$" }}{{ end }}