deploy: docker compose stack, api image, install script, proxy configs

Postgres and AMI secrets are hex (the password goes into DATABASE_URL).

Task: M0-T6

.env.example

@@ -0,0 +1,16 @@
+# --- required ---
+PUBLIC_HOSTNAME=pbx.example.com      # DNS name browsers and phones use
+POSTGRES_PASSWORD=change-me          # install.sh generates a random one (hex: it goes into a URL)
+AMI_SECRET=change-me                 # install.sh generates a random one
+APP_SECRET=change-me                 # 32 random bytes, base64. Encrypts secrets in the DB. NEVER change after first run.
+INITIAL_ADMIN_EMAIL=admin@example.com
+INITIAL_ADMIN_PASSWORD=change-me     # only used if no admin exists yet
+
+# --- optional ---
+TZ=America/Chicago
+API_PORT=8080
+POSTGRES_PORT=5433
+APP_UID=1000
+APP_GID=1000
+LOG_LEVEL=info
+TRUST_PROXY=true                     # true when behind Caddy/nginx