Permanently eliminate the "$X variable not set" warning, and fix Caddy auto-HTTPS on private IPs

Two separate leaks were causing the same cosmetic-but-annoying warning to
survive every previous fix attempt:

1. Compose's own `secrets:` block reads the referenced file's *content*
   as part of its config model, and applies the same interpolation
   warning to it — even with DB_PASSWORD fully removed from every ${VAR}
   and --env-file path. Switched from Compose's native `secrets:` to plain
   bind mounts at the same /run/secrets/* paths: a bind mount only ever
   touches the file's path, never its content, so it's immune. (Verified
   this precisely with an isolated repro before rolling it out — the two
   mechanisms behave differently even though they look equivalent.)

2. caddy's `env_file: .env.staging` (a leftover from the since-removed
   basic-auth setup) loaded the *raw*, unfiltered env file directly,
   bypassing deploy.sh/backup.sh/restore.sh's filtered-copy mechanism
   entirely. Caddy only ever needed SITE_DOMAIN; switched to passing that
   one value directly instead of the whole file.

Also fixed Caddyfile.staging: the site address had no explicit scheme, so
Caddy's automatic-HTTPS logic still applied to a private IP (registering
its own internal CA and redirecting HTTP->HTTPS) — not the "plain HTTP
only" behavior I'd assumed and told the user earlier. Prefixed with
`http://` to genuinely disable automatic HTTPS for this LAN-only box.

Verified end-to-end: fresh deploy with dollar-sign DB passwords produces
zero warnings, serves HTTP 200 on plain http:// with no redirect, and the
DB connection genuinely authenticates.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -12,10 +12,20 @@
 # support a `_FILE` convention specifically for this — point at a file path
 # (never risky) and the container reads the raw contents itself, bypassing
 # Compose's interpolation entirely. deploy.sh writes these files fresh from
-# .env.<environment> before every `up`. The supplier/payment keys below are
-# still passed the old way and remain exposed to the same class of bug —
-# nothing consumes them yet (bookstore-core is still a stub), so when that
-# code is written it should read `_FILE` variants the same way.
+# .env.<environment> before every `up`.
+#
+# These are plain bind mounts, NOT Compose's native `secrets:` block —
+# Compose's `secrets:` construct reads the referenced file's *content* as
+# part of its own config model and applies the same interpolation warning
+# to it (confirmed: it still warned on "$BRjTx3tlmSpz" even after that
+# value was fully removed from every ${VAR} and --env-file path). A plain
+# bind mount never touches the file's content, only its path, so it's
+# immune to this entirely.
+#
+# The supplier/payment keys below are still passed the old ${VAR} way and
+# remain exposed to the same class of bug — nothing consumes them yet
+# (bookstore-core is still a stub), so when that code is written it should
+# read `_FILE` variants the same way.
 x-bookstore-env: &bookstore-env
   WORDPRESS_DB_HOST: db
   WORDPRESS_DB_NAME: ${DB_NAME}
@@ -38,15 +48,6 @@ x-bookstore-env: &bookstore-env
   HELCIM_ACCOUNT_ID: ${HELCIM_ACCOUNT_ID:-}
   MAILERLITE_API_KEY: ${MAILERLITE_API_KEY:-}
 
-x-bookstore-secrets: &bookstore-db-secret
-  - db_password
-
-secrets:
-  db_password:
-    file: ./secrets/${ENVIRONMENT}/db_password
-  db_root_password:
-    file: ./secrets/${ENVIRONMENT}/db_root_password
-
 services:
   db:
     image: mariadb:11
@@ -56,11 +57,10 @@ services:
       MARIADB_USER: ${DB_USER}
       MARIADB_PASSWORD_FILE: /run/secrets/db_password
       MARIADB_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
-    secrets:
-      - db_password
-      - db_root_password
     volumes:
       - db_data:/var/lib/mysql
+      - ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
+      - ./secrets/${ENVIRONMENT}/db_root_password:/run/secrets/db_root_password:ro
     healthcheck:
       test: ["CMD-SHELL", "mariadb-admin ping -h 127.0.0.1 -u$$MARIADB_USER -p\"$$(cat /run/secrets/db_password)\" --silent"]
       interval: 5s
@@ -88,13 +88,13 @@ services:
       redis:
         condition: service_healthy
     environment: *bookstore-env
-    secrets: *bookstore-db-secret
     volumes:
       - wp_core:/var/www/html
       - wp_uploads:/var/www/html/wp-content/uploads
       - wp_themes:/var/www/html/wp-content/themes
       - ./wp-content/plugins/bookstore-core:/var/www/html/wp-content/plugins/bookstore-core
       - ./wp-content/mu-plugins:/var/www/html/wp-content/mu-plugins
+      - ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
 
   cron:
     build:
@@ -104,7 +104,6 @@ services:
       - wordpress
     entrypoint: ["/bin/sh", "/usr/local/bin/cron-entrypoint.sh"]
     environment: *bookstore-env
-    secrets: *bookstore-db-secret
     volumes:
       - wp_core:/var/www/html
       - wp_uploads:/var/www/html/wp-content/uploads
@@ -112,6 +111,7 @@ services:
       - ./wp-content/plugins/bookstore-core:/var/www/html/wp-content/plugins/bookstore-core
       - ./wp-content/mu-plugins:/var/www/html/wp-content/mu-plugins
       - ./docker/cron/entrypoint.sh:/usr/local/bin/cron-entrypoint.sh:ro
+      - ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
 
 volumes:
   db_data: