fix(deploy): let app own secret key — remove STEWARD_SECRET_KEY from deploy compose

The app auto-generates a key on first boot and persists it to /data/secret.key,
which the app_data volume keeps across image updates. No reason to surface this
as a user-facing env var in the deploy compose. Removed from .env.example too.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -1,7 +1,6 @@
 # Copy to .env for Docker / local development secrets
 # These override values in config.yaml
 
-STEWARD_SECRET_KEY=change-me
 STEWARD_DATABASE_URL=postgresql+asyncpg://steward:password@localhost/steward
 STEWARD_SMTP__PASSWORD=