Ristruttura il deploy: immagine autosufficiente per Dokploy

Il Dockerfile compilava l'applicazione in /app-src mentre il runtime girava
da /var/www/html, popolato solo dal bind mount del sorgente: l'immagine
costruita non veniva mai usata. L'entrypoint rieseguiva composer install e
npm run build a ogni avvio, dentro il container. Su Dokploy, senza sorgente
sull'host, questo significava build a runtime a ogni deploy.

Ora vendor/ e public/build sono compilati in stage separati e copiati
nell'immagine finale. I container di produzione non montano il sorgente e
non eseguono build all'avvio: un redeploy e' build, migrazioni, online.

- Dockerfile multi-stage (composer, node, runtime)
- nginx e php-fpm nello stesso container via supervisor: con container
  separati nginx avrebbe bisogno di una copia di public/ e del volume
  storage solo per servire file statici
- clear_env = no in www.conf, senza cui php-fpm nasconde a Laravel tutte
  le variabili d'ambiente
- configurazione da ambiente di processo invece di .env riscritto con sed;
  il compose fissa solo i valori dettati dalla topologia
- fail-fast su APP_URL, DB_PASSWORD, DB_ROOT_PASSWORD, REDIS_PASSWORD
- servizio scheduler dedicato: schedule:work non veniva mai eseguito,
  quindi la pulizia dell'audit log non e' mai partita
- solo il container app esegue le migrazioni, per evitare che due
  container in gara lascino uno schema applicato a meta'
- healthcheck separati per worker e scheduler, che non espongono HTTP
- docker-compose.dev.yml per lo sviluppo locale
- documentazione unificata in README.md e HANDOFF.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -1,42 +1,88 @@
-APP_NAME=TerManager2
-APP_ENV=local
-APP_KEY=
-APP_DEBUG=true
-APP_TIMEZONE=Europe/Rome
-APP_URL=https://demo-termanager.pyconetwork.it
-ASSET_URL=https://demo-termanager.pyconetwork.it
+# =============================================================================
+# TerManager2 — environment template
+#
+# LOCAL DEVELOPMENT: copy to .env and adjust.
+#   cp .env.example .env && docker compose -f docker-compose.dev.yml up -d
+#
+# PRODUCTION (Dokploy): do NOT ship a .env file. Set these as environment
+# variables in the Dokploy UI instead — the container reads them directly.
+# Variables marked [REQUIRED] have no safe default and the stack will refuse
+# to start without them.
+# =============================================================================
 
-APP_PORT=8080
-SEED_DEV_DATA=false
-RUN_DB_SEED_ON_FIRST_START=true
-ENSURE_INITIAL_ADMIN_ON_EMPTY_DB=true
-INITIAL_ADMIN_NAME=
+APP_NAME=TerManager2
+APP_ENV=production
+APP_DEBUG=false
+APP_TIMEZONE=Europe/Rome
+
+# [REQUIRED] Generate with: php artisan key:generate --show
+# Proclamatori personal data is encrypted with this key. If it changes or is
+# lost, that data becomes permanently unreadable. Back it up.
+APP_KEY=
+
+# [REQUIRED] Public URL, including scheme. Used for links in PDFs and emails,
+# and to validate the incoming Host header.
+APP_URL=https://territori.example.org
+
+LOG_CHANNEL=stderr
+LOG_LEVEL=warning
+
+# -----------------------------------------------------------------------------
+# First-run bootstrap
+# -----------------------------------------------------------------------------
+# The admin account created on first deploy. Change the password after login.
+INITIAL_ADMIN_NAME=Amministratore
 INITIAL_ADMIN_EMAIL=
 INITIAL_ADMIN_PASSWORD=
 
+# Leave these at their defaults; they exist as escape hatches.
+RUN_MIGRATIONS=true
+RUN_DB_SEED_ON_FIRST_START=true
+ENSURE_INITIAL_ADMIN_ON_EMPTY_DB=true
+
+# -----------------------------------------------------------------------------
+# Database — hostnames are fixed by docker-compose.yml
+# -----------------------------------------------------------------------------
 DB_CONNECTION=mysql
 DB_HOST=mariadb
 DB_PORT=3306
 DB_DATABASE=termanager2
 DB_USERNAME=termanager2
-DB_PASSWORD=secret
-DB_ROOT_PASSWORD=rootsecret
 
+# [REQUIRED] No defaults on purpose — generate with: openssl rand -base64 24
+DB_PASSWORD=
+DB_ROOT_PASSWORD=
+
+# -----------------------------------------------------------------------------
+# Redis (cache, sessions, queue)
+# -----------------------------------------------------------------------------
 REDIS_HOST=redis
-REDIS_PASSWORD=redissecret
 REDIS_PORT=6379
+# [REQUIRED] openssl rand -base64 24
+REDIS_PASSWORD=
 
 CACHE_STORE=redis
 SESSION_DRIVER=redis
+SESSION_SECURE_COOKIE=true
 QUEUE_CONNECTION=redis
 
+# -----------------------------------------------------------------------------
+# Mail — external SMTP. Use MAIL_MAILER=log to disable delivery entirely.
+# -----------------------------------------------------------------------------
 MAIL_MAILER=smtp
-MAIL_HOST=mailpit
-MAIL_PORT=1025
-MAIL_USERNAME=null
-MAIL_PASSWORD=null
-MAIL_ENCRYPTION=null
-MAIL_FROM_ADDRESS="noreply@termanager2.local"
+MAIL_HOST=
+MAIL_PORT=587
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_SCHEME=tls
+MAIL_FROM_ADDRESS=noreply@example.org
 MAIL_FROM_NAME="${APP_NAME}"
 
+# -----------------------------------------------------------------------------
+# Local development only — ignored in production
+# -----------------------------------------------------------------------------
+# Host port for docker-compose.dev.yml. In production Traefik handles routing
+# and no port is published.
+APP_PORT=8080
 MAILPIT_UI_PORT=8025
+SEED_DEV_DATA=false