stacks: add .env + .env.secrets.ctmpl for productivity stacks

Adds real Vault Agent secret templates and non-secret env vars for
all 9 productivity stacks. Sanitized several real leaks: a real
residential public IP (ghost's UMAMI_IGNORE_IP), real personal
domains/email used across joplin/n8n/ghost/paperless-ngx, and a
real embedded OAuth client ID in paperless-ngx's private OIDC config
(dropped entirely - the public compose file doesn't wire up OIDC at
all, so none of that config was needed).

Also dropped n8n secrets referencing the out-of-scope Content
Pipeline system (nocodb-content, Postiz), and did not carry over a
real Redis password found sitting in plaintext in nextcloud's
private .env (unused by the public compose anyway).

Every var cross-checked against what its actual public compose file
references before writing.

stacks/productivity/ghost/.env

@@ -0,0 +1,21 @@
+HTTP_PORT=10368
+TZ=Etc/UTC
+
+GHOST_URL=https://blog.example.com
+
+UMAMI_IGNORE_IP=203.0.113.1
+
+DB_HOST=ghost_db
+DB_NAME=ghostdb
+DB_USER=ghostuser
+
+UMAMI_PORT=3050
+UMAMI_DB_NAME=umami
+UMAMI_DB_USER=umami
+
+SMTP_TRANSPORT=SMTP
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+
+SMTP_USER=[email protected]

stacks/productivity/ghost/.env.secrets.ctmpl

@@ -0,0 +1,5 @@
+DB_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.db_password }}{{ end }}
+SMTP_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.smtp_password }}{{ end }}
+MYSQL_ROOT_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.mysql_root_password }}{{ end }}
+UMAMI_APP_SECRET={{ with secret "kv/host/ghost" }}{{ .Data.data.umami_app_secret }}{{ end }}
+UMAMI_DB_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.umami_db_password }}{{ end }}