fix(compose): propagate SECRET_KEY to all workers, not just backend

The workers couldn't decrypt users.nextcloud_app_password_enc because
SECRET_KEY wasn't in their env. _credentials_for() then raised
NextcloudCredentialsMissing and our code swallowed it as "no NC
auth → fall back to local path."

Surfaced on the Phase 4 deploy when /data/thumbs/.../medium.webp
was purged and the vision worker had no disk fallback left. NC
preview fetch then returned None, the classifier got no image,
and the photo failed to classify.

Also masked Phase 3 silently — extract_metadata in worker-light
was falling back to ExifTool every time instead of hitting Memories
(which would have been fine because ExifTool produces the same
fields, but slower and unnecessary). With SECRET_KEY available, the
Memories primary path actually fires.

docker-compose.yml

@@ -98,6 +98,7 @@ services:
       - NEXTCLOUD_USERS_ROOT=${NEXTCLOUD_USERS_ROOT:-/nextcloud-users}
       - NEXTCLOUD_BASE_URL=${NEXTCLOUD_BASE_URL:-}
       - NEXTCLOUD_WEBHOOK_SECRET=${NEXTCLOUD_WEBHOOK_SECRET:-}
+      - SECRET_KEY=${SECRET_KEY:-mulita-dev-secret-change-me}
       - LOG_LEVEL=${LOG_LEVEL:-INFO}
       - TZ=${TZ:-UTC}
     depends_on:
@@ -162,6 +163,7 @@ services:
       - NEXTCLOUD_USERS_ROOT=${NEXTCLOUD_USERS_ROOT:-/nextcloud-users}
       - NEXTCLOUD_BASE_URL=${NEXTCLOUD_BASE_URL:-}
       - NEXTCLOUD_WEBHOOK_SECRET=${NEXTCLOUD_WEBHOOK_SECRET:-}
+      - SECRET_KEY=${SECRET_KEY:-mulita-dev-secret-change-me}
       - LOG_LEVEL=${LOG_LEVEL:-INFO}
       - TZ=${TZ:-UTC}
       # NullPool — see app/database.py for rationale.
@@ -223,6 +225,7 @@ services:
       - NEXTCLOUD_USERS_ROOT=${NEXTCLOUD_USERS_ROOT:-/nextcloud-users}
       - NEXTCLOUD_BASE_URL=${NEXTCLOUD_BASE_URL:-}
       - NEXTCLOUD_WEBHOOK_SECRET=${NEXTCLOUD_WEBHOOK_SECRET:-}
+      - SECRET_KEY=${SECRET_KEY:-mulita-dev-secret-change-me}
       - LOG_LEVEL=${LOG_LEVEL:-INFO}
       - TZ=${TZ:-UTC}
       - MULITA_CELERY_WORKER=1