chore: docker compose ergonomics — rename dev override, bake dev defaults

- Renamed docker-compose.dev.yml → docker-compose.override.yml so Docker
  Compose auto-merges it. `docker compose up` (no -f) now Just Works for
  local development.

- Removed the `env_file: .env` requirement from every service in the base
  file. Operators no longer need to create a .env to bring the stack up.

- Baked sane dev defaults directly into docker-compose.yml via
  ${VAR:-default} interpolation:
    DB_USER=fabledcurator
    DB_PASSWORD=fabledcurator_dev
    DB_NAME=fabledcurator
    SECRET_KEY=dev_secret_key_not_for_production_change_me
    LOG_LEVEL=INFO (overridden to DEBUG by the dev override)

  Defaults are insecure but explicitly named so. For production, override
  via shell env vars or a .env file at the project root.

- README quick-start simplified to a single `docker compose up -d`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -1,3 +1,13 @@
+# Base compose stack. Uses ${VAR:-default} interpolation throughout so the
+# stack boots with zero config — sane dev defaults baked in. For production
+# deployments, override the defaults via shell env vars or a .env file:
+#
+#     DB_PASSWORD=...real... SECRET_KEY=...real... docker compose up
+#
+# The dev override (docker-compose.override.yml) is auto-merged when you
+# run `docker compose up` from this directory and switches images to
+# local builds + DEBUG logging.
+
 services:
   redis:
     image: redis:7-alpine
@@ -13,7 +23,7 @@ services:
     image: pgvector/pgvector:pg16
     environment:
       POSTGRES_USER: ${DB_USER:-fabledcurator}
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:-fabledcurator_dev}
       POSTGRES_DB: ${DB_NAME:-fabledcurator}
     volumes:
       - postgres_data:/var/lib/postgresql/data
@@ -28,12 +38,17 @@ services:
     command: ["web"]
     ports:
       - "${PORT:-8080}:8080"
-    env_file: .env
     environment: &app_env
+      DB_USER: ${DB_USER:-fabledcurator}
+      DB_PASSWORD: ${DB_PASSWORD:-fabledcurator_dev}
       DB_HOST: postgres
       DB_PORT: "5432"
+      DB_NAME: ${DB_NAME:-fabledcurator}
       CELERY_BROKER_URL: redis://redis:6379/0
       CELERY_RESULT_BACKEND: redis://redis:6379/0
+      SECRET_KEY: ${SECRET_KEY:-dev_secret_key_not_for_production_change_me}
+      EXTENSION_API_KEY: ${EXTENSION_API_KEY:-}
+      LOG_LEVEL: ${LOG_LEVEL:-INFO}
     volumes:
       - ./images:/images
       - ./import:/import
@@ -49,7 +64,6 @@ services:
       <<: *app_env
       CELERY_QUEUES: default,import,thumbnail,download
       CELERY_CONCURRENCY: "2"
-    env_file: .env
     volumes:
       - ./images:/images
       - ./import:/import
@@ -64,7 +78,6 @@ services:
     environment:
       <<: *app_env
       CELERY_QUEUES: maintenance,scan
-    env_file: .env
     volumes:
       - ./images:/images
       - ./import:/import
@@ -78,7 +91,6 @@ services:
     command: ["ml-worker"]
     environment:
       <<: *app_env
-    env_file: .env
     volumes:
       - ./images:/images:ro
       - ./models:/models