feat: add Docker _FILE secret convention for sensitive env vars (#205)

Support reading secrets from mounted files instead of plain-text
environment variables, following the standard Docker/Kubernetes
convention used by MariaDB, Postgres, and Stirling-PDF.

Supported vars: DEFAULT_PASSWORD, S3_ACCESS_KEY_ID,
S3_SECRET_ACCESS_KEY, OIDC_CLIENT_SECRET, COOKIE_SECRET,
SNAPOTTER_LICENSE_KEY.

docker/docker-compose.yml

@@ -50,6 +50,15 @@ services:
       # - OIDC_USERNAME_CLAIM=preferred_username
       # - OIDC_CLOCK_TOLERANCE=30
       # - COOKIE_SECRET=
+      #
+      # Docker secrets (_FILE convention): mount secrets as files instead of
+      # passing them as plain-text env vars. Supported for sensitive vars only.
+      # - DEFAULT_PASSWORD_FILE=/run/secrets/snapotter_password
+      # - S3_ACCESS_KEY_ID_FILE=/run/secrets/s3_access_key
+      # - S3_SECRET_ACCESS_KEY_FILE=/run/secrets/s3_secret_key
+      # - OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_secret
+      # - COOKIE_SECRET_FILE=/run/secrets/cookie_secret
+      # - SNAPOTTER_LICENSE_KEY_FILE=/run/secrets/license_key
     restart: unless-stopped
     # --- Security hardening ---
     mem_limit: 6g
@@ -83,6 +92,13 @@ services:
         max-size: "50m"
         max-file: "5"
 
+# Uncomment to use Docker secrets (requires Docker Swarm or compose v2.23+):
+# secrets:
+#   snapotter_password:
+#     file: ./secrets/snapotter_password.txt
+#   oidc_secret:
+#     file: ./secrets/oidc_secret.txt
+
 volumes:
   SnapOtter-data:
   SnapOtter-workspace: