stacks: add .env + .env.secrets.ctmpl for platform stacks, fix var-name mismatches

Adds real Vault Agent secret templates and non-secret env vars for
14 platform stacks (caddy, caddy-internal, dashy, docker-socket-
proxy, dockhand, gitea, grafana-stack, hawser, kestra, kopia,
mosquitto, nocodb, node-red, speedtest-tracker), sanitized per the
kv/host/... convention established for identity-and-security.

Also fixes 6 variable-name mismatches discovered while cross-checking
every new .env/.ctmpl against what its actual public compose file
references (the public compose files were already adapted from the
private originals during an earlier reorg pass, so names don't always
match 1:1): authentik (PG_USER/PG_DB/PG_PASS), gitea (added
GITEA_DOMAIN/GITEA_ROOT_URL, dropped an unused duplicate-instance pair
of vars), grafana-stack (GRAFANA_ADMIN_PASSWORD), kestra (added
USERNAME/PASSWORD), kopia (SECRET_PASSWORD), nocodb (JWT_SECRET).
Also dropped an unused DOCKER var across most stacks where the
compose file hardcodes its path instead of referencing it.

stacks/platform/node-red/.env

@@ -0,0 +1,10 @@
+# Exposed HTTP port
+HTTP_PORT=1856
+
+# System time zone
+TZ=Etc/UTC
+
+# ID's
+PUID=1000
+PGID=1000
+

stacks/platform/node-red/.env.secrets.ctmpl

@@ -0,0 +1,21 @@
+PAPERLESS_API_TOKEN={{ with secret "kv/host/node-red" }}{{ .Data.data.paperless_api_token }}{{ end }}
+FIREFLY_API_TOKEN={{ with secret "kv/host/node-red" }}{{ .Data.data.firefly_api_token }}{{ end }}
+{{ with secret "kv/host/node-red" }}
+ABS_TOKEN={{ .Data.data.abs_token }}
+AUTHENTIK_TOKEN={{ .Data.data.authentik_token }}
+BAZARR_KEY={{ .Data.data.bazarr_key }}
+JELLYFIN_KEY={{ .Data.data.jellyfin_key }}
+KESTRA_PASS={{ .Data.data.kestra_pass }}
+LIDARR_KEY={{ .Data.data.lidarr_key }}
+NOCODB_TOKEN={{ .Data.data.nocodb_token }}
+PBS_API_TOKEN={{ .Data.data.pbs_api_token }}
+PVE_API_TOKEN={{ .Data.data.pve_api_token }}
+RADARR_KEY={{ .Data.data.radarr_key }}
+SEERR_KEY={{ .Data.data.seerr_key }}
+SLACK_TOKEN={{ .Data.data.slack_token }}
+SONARR_KEY={{ .Data.data.sonarr_key }}
+TECHNITIUM_TOKEN={{ .Data.data.technitium_token }}
+VAULT_TOKEN={{ .Data.data.vault_token }}
+WAZUH_API_PASS={{ .Data.data.wazuh_api_pass }}
+WAZUH_INDEXER_AUTH={{ .Data.data.wazuh_indexer_auth }}
+{{ end }}