Move all sensitive and configurable values out of compose.yaml
into a .env file (mode 0600). compose.yaml now uses ${VAR}
substitution with no embedded secrets. Added planka.env.j2
template and a dedicated Deploy .env task in the playbook.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>