fix: pass OIDC_OFFLINE_ACCESS through to the app container

The app service's environment block is an explicit allow-list, not
env_file — as the comment two lines above this change says, a var added
to .env but not listed here never reaches the container.

PR #20 added OIDC_OFFLINE_ACCESS to .env.example and documented it in the
README but missed this, so setting it in .env would have been silently
ignored and the refresh-token fix would not have taken effect. Caught
while deploying, before it could look like the IdP change had failed.

The external-db override merges its environment block rather than
replacing it, so it inherits this and needs no equivalent change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -117,6 +117,7 @@ services:
       # added to .env but not listed here never reaches the container.
       OIDC_ISSUER_MCP: ${OIDC_ISSUER_MCP:-}
       OIDC_AUDIENCE_SCOPE: ${OIDC_AUDIENCE_SCOPE:-}
+      OIDC_OFFLINE_ACCESS: ${OIDC_OFFLINE_ACCESS:-}
       PLUGIN_MARKETPLACE_URL: ${PLUGIN_MARKETPLACE_URL:-}
       PLUGIN_MARKETPLACE_NAME: ${PLUGIN_MARKETPLACE_NAME:-shared-memory}