Fix five high-severity bugs from the full-session code review

- ProductSync: bsc_work.wc_product_id could go stale if a product was ever
  deleted out-of-band (wp-admin, a cleanup script). wc_get_product() then
  correctly detects "no product" and creates a new one, but the repoint was
  gated behind `if (!$existing_id)` — which was already true, so the stale
  ID never got corrected. Every future sync repeated this, one duplicate
  product per run. Fixed by making the repoint unconditional (cheap,
  idempotent UPDATE either way). Reproduced the exact scenario against dev
  (deleted a product out-of-band, ran sync-products twice) and confirmed:
  one repoint, zero duplicates, product count and per-work product count
  both correct across repeated runs.

- Commands.php (sync-hardcover-tags): wp_set_object_terms() with an empty
  array clears the taxonomy rather than leaving it alone — verified
  directly. Hardcover legitimately returns no moods/content-warnings for
  plenty of books, so a --force re-sync could silently wipe existing tags,
  including anything hand-tagged. Fixed by skipping the call per-category
  when that category's array is empty. Verified via a direct eval test:
  pre-existing genre tag survives a sync where genre comes back empty,
  mood still gets set normally.

- docker-compose.yml: two stray root-owned secrets/db_password and
  secrets/db_root_password directories were already sitting on disk —
  Docker auto-creating a bind-mount source as a directory from an earlier
  manual `docker compose` call that ran without ENVIRONMENT exported
  (reproducing the exact bug already fixed once this session). Removed
  the stray dirs and changed every `${ENVIRONMENT}` in a volume mount to
  `${ENVIRONMENT:?ENVIRONMENT must be set}` so Compose now hard-fails
  instead of silently defaulting to empty. Verified: unset ENVIRONMENT now
  fails config validation with a clear error; set, it still works.

- HARDCOVER_API_TOKEN moved to the same _FILE secrets pattern already used
  for DB_PASSWORD/DB_ROOT_PASSWORD (docker-compose.yml, deploy.sh,
  HardcoverAdapter.php) — it was a live, consumed secret still going
  through Compose's ${VAR} interpolation, exposed to the same
  mangling bug already fixed for the DB passwords, plus visible via
  `docker inspect`. deploy.sh now writes secrets/<env>/hardcover_api_token
  (optionally empty). Verified via deploy.sh dev + wp eval: empty file ->
  is_configured() false, a real token value -> true.

- backup.sh: mariadb-dump had no --single-transaction, so a dump against a
  live site would either table-lock for its duration or produce a
  non-atomic/inconsistent dump. Added; verified a real dump still runs
  clean and produces a valid, restorable-looking .sql.gz.

docker-compose.yml

@@ -22,10 +22,11 @@
 # bind mount never touches the file's content, only its path, so it's
 # immune to this entirely.
 #
-# The supplier/payment keys below are still passed the old ${VAR} way and
-# remain exposed to the same class of bug — nothing consumes them yet
-# (bookstore-core is still a stub), so when that code is written it should
-# read `_FILE` variants the same way.
+# The remaining supplier/payment keys below are still passed the old ${VAR}
+# way and remain exposed to the same class of bug — nothing consumes them
+# yet (bookstore-core is still a stub for those), so when that code is
+# written it should read `_FILE` variants the same way HARDCOVER_API_TOKEN
+# now does below.
 x-bookstore-env: &bookstore-env
   WORDPRESS_DB_HOST: db
   WORDPRESS_DB_NAME: ${DB_NAME}
@@ -47,7 +48,7 @@ x-bookstore-env: &bookstore-env
   HELCIM_API_TOKEN: ${HELCIM_API_TOKEN:-}
   HELCIM_ACCOUNT_ID: ${HELCIM_ACCOUNT_ID:-}
   MAILERLITE_API_KEY: ${MAILERLITE_API_KEY:-}
-  HARDCOVER_API_TOKEN: ${HARDCOVER_API_TOKEN:-}
+  HARDCOVER_API_TOKEN_FILE: /run/secrets/hardcover_api_token
 
 services:
   db:
@@ -60,8 +61,8 @@ services:
       MARIADB_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
     volumes:
       - db_data:/var/lib/mysql
-      - ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
-      - ./secrets/${ENVIRONMENT}/db_root_password:/run/secrets/db_root_password:ro
+      - ./secrets/${ENVIRONMENT:?ENVIRONMENT must be set}/db_password:/run/secrets/db_password:ro
+      - ./secrets/${ENVIRONMENT:?ENVIRONMENT must be set}/db_root_password:/run/secrets/db_root_password:ro
     healthcheck:
       test: ["CMD-SHELL", "mariadb-admin ping -h 127.0.0.1 -u$$MARIADB_USER -p\"$$(cat /run/secrets/db_password)\" --silent"]
       interval: 5s
@@ -95,7 +96,8 @@ services:
       - wp_themes:/var/www/html/wp-content/themes
       - ./wp-content/plugins/bookstore-core:/var/www/html/wp-content/plugins/bookstore-core
       - ./wp-content/mu-plugins:/var/www/html/wp-content/mu-plugins
-      - ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
+      - ./secrets/${ENVIRONMENT:?ENVIRONMENT must be set}/db_password:/run/secrets/db_password:ro
+      - ./secrets/${ENVIRONMENT:?ENVIRONMENT must be set}/hardcover_api_token:/run/secrets/hardcover_api_token:ro
 
   cron:
     build:
@@ -119,7 +121,8 @@ services:
       - ./wp-content/plugins/bookstore-core:/var/www/html/wp-content/plugins/bookstore-core
       - ./wp-content/mu-plugins:/var/www/html/wp-content/mu-plugins
       - ./docker/cron/entrypoint.sh:/usr/local/bin/cron-entrypoint.sh:ro
-      - ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
+      - ./secrets/${ENVIRONMENT:?ENVIRONMENT must be set}/db_password:/run/secrets/db_password:ro
+      - ./secrets/${ENVIRONMENT:?ENVIRONMENT must be set}/hardcover_api_token:/run/secrets/hardcover_api_token:ro
 
 volumes:
   db_data: