stacks: add .env + .env.secrets.ctmpl for platform stacks, fix var-name mismatches

Adds real Vault Agent secret templates and non-secret env vars for
14 platform stacks (caddy, caddy-internal, dashy, docker-socket-
proxy, dockhand, gitea, grafana-stack, hawser, kestra, kopia,
mosquitto, nocodb, node-red, speedtest-tracker), sanitized per the
kv/host/... convention established for identity-and-security.

Also fixes 6 variable-name mismatches discovered while cross-checking
every new .env/.ctmpl against what its actual public compose file
references (the public compose files were already adapted from the
private originals during an earlier reorg pass, so names don't always
match 1:1): authentik (PG_USER/PG_DB/PG_PASS), gitea (added
GITEA_DOMAIN/GITEA_ROOT_URL, dropped an unused duplicate-instance pair
of vars), grafana-stack (GRAFANA_ADMIN_PASSWORD), kestra (added
USERNAME/PASSWORD), kopia (SECRET_PASSWORD), nocodb (JWT_SECRET).
Also dropped an unused DOCKER var across most stacks where the
compose file hardcodes its path instead of referencing it.

stacks/platform/nocodb/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=8090
+
+# System time zone
+TZ=Etc/UTC
+
+
+# DB Creds
+POSTGRES_DB=nocodb
+POSTGRES_USER=nocodb

stacks/platform/nocodb/.env.secrets.ctmpl

@@ -0,0 +1,3 @@
+NC_DB=pg://nocodb_db:5432?u=nocodb&p={{ with secret "kv/host/nocodb" }}{{ .Data.data.postgres_password }}{{ end }}&d=nocodb
+JWT_SECRET={{ with secret "kv/host/nocodb" }}{{ .Data.data.jwt_secret }}{{ end }}
+POSTGRES_PASSWORD={{ with secret "kv/host/nocodb" }}{{ .Data.data.postgres_password }}{{ end }}