stacks: add .env + .env.secrets.ctmpl for productivity stacks

Adds real Vault Agent secret templates and non-secret env vars for
all 9 productivity stacks. Sanitized several real leaks: a real
residential public IP (ghost's UMAMI_IGNORE_IP), real personal
domains/email used across joplin/n8n/ghost/paperless-ngx, and a
real embedded OAuth client ID in paperless-ngx's private OIDC config
(dropped entirely - the public compose file doesn't wire up OIDC at
all, so none of that config was needed).

Also dropped n8n secrets referencing the out-of-scope Content
Pipeline system (nocodb-content, Postiz), and did not carry over a
real Redis password found sitting in plaintext in nextcloud's
private .env (unused by the public compose anyway).

Every var cross-checked against what its actual public compose file
references before writing.

stacks/productivity/joplin/.env

@@ -0,0 +1,25 @@
+# Exposed HTTP port
+HTTP_PORT=22300
+POSTGRES_PORT=5432
+
+# System time zone
+TZ=Etc/UTC
+
+# User Credentials
+APP_BASE_URL=https://notes.example.com
+
+# Admin account seed (only read on a fresh first-ever boot, e.g. after a full recreate)
+APP_ADMIN_EMAIL=[email protected]
+APP_ADMIN_NAME=admin
+
+# SMTP Settings
+MAILER_HOST=smtp.example.com
+MAILER_PORT=587
+MAILER_SECURITY=1
+MAILER_AUTH_USER=[email protected]
+MAILER_NOREPLY_NAME=JoplinServer
+MAILER_NOREPLY_EMAIL=[email protected]
+
+# Postgres Creds
+POSTGRES_USER=postgres
+POSTGRES_DB=joplin

stacks/productivity/joplin/.env.secrets.ctmpl

@@ -0,0 +1,3 @@
+POSTGRES_PASSWORD={{ with secret "kv/host/joplin" }}{{ .Data.data.postgres_password }}{{ end }}
+MAILER_AUTH_PASSWORD={{ with secret "kv/host/joplin" }}{{ .Data.data.mailer_auth_password }}{{ end }}
+APP_ADMIN_PASSWORD={{ with secret "kv/host/joplin" }}{{ .Data.data.app_admin_password }}{{ end }}