fix(compose): pass CLI_TOKEN_SECRET through to the app service

The explicit `environment:` map in compose filters which .env vars reach
the container. Adding CLI_TOKEN_SECRET so the new CLI-token verifier can
read it at runtime.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -92,6 +92,7 @@ services:
       EMBEDDING_DIM: ${EMBEDDING_DIM:-384}
 
       NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:?required}
+      CLI_TOKEN_SECRET: ${CLI_TOKEN_SECRET:?required}
     ports:
       # Exposed to the host so an external reverse proxy (HAProxy, nginx,
       # etc.) can reach the app. When using the `tls` profile, Caddy also