chore: docker compose ergonomics — rename dev override, bake dev defaults

- Renamed docker-compose.dev.yml → docker-compose.override.yml so Docker
  Compose auto-merges it. `docker compose up` (no -f) now Just Works for
  local development.

- Removed the `env_file: .env` requirement from every service in the base
  file. Operators no longer need to create a .env to bring the stack up.

- Baked sane dev defaults directly into docker-compose.yml via
  ${VAR:-default} interpolation:
    DB_USER=fabledcurator
    DB_PASSWORD=fabledcurator_dev
    DB_NAME=fabledcurator
    SECRET_KEY=dev_secret_key_not_for_production_change_me
    LOG_LEVEL=INFO (overridden to DEBUG by the dev override)

  Defaults are insecure but explicitly named so. For production, override
  via shell env vars or a .env file at the project root.

- README quick-start simplified to a single `docker compose up -d`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -10,13 +10,25 @@ Pre-v1. Not yet functional.
 
 ## Quick start
 
+For local development and testing, just:
+
 ```bash
-cp .env.example .env
-# edit .env: set DB_PASSWORD and SECRET_KEY
 docker compose up -d
 # UI: http://localhost:8080
 ```
 
+That uses sane dev defaults baked into `docker-compose.yml` and the dev
+override (`docker-compose.override.yml`, auto-merged) — local builds, DEBUG
+logging, exposed Postgres + Redis ports on the host. No `.env` required.
+
+For a production-like deployment, override the dev defaults via shell env
+or a `.env` file (see `.env.example` for the variable names) and use:
+
+```bash
+docker compose -f docker-compose.yml up -d
+# (skips the override so containers pull registry images)
+```
+
 ## Deployment posture
 
 FabledCurator is designed to run inside a self-hosted homelab environment over plain HTTP. If you want TLS, terminate it at your reverse proxy. The app does not generate certificates, redirect to HTTPS, or set HSTS.