fix(compose): make BASE_URL/COOKIE_SECURE configurable, drop obsolete version

Address compose issues surfaced on first production deploy:

- Remove obsolete `version: "3.8"` (ignored by Compose v2; caused a warning).
- Fix BASE_URL: it used compose-time interpolation of ${SERVER_PORT}, which is
  only defined as a runtime container env var (invisible to interpolation) and
  absent from .env. This resolved to an empty string, producing a broken
  `http://localhost:` (no port) and a startup warning. Now
  ${BASE_URL:-http://localhost:8765}, overridable per-deployment via .env.
- Move COOKIE_SECURE from the db service to the app service and make it
  configurable (${COOKIE_SECURE:-false}). It controls the session cookie Secure
  flag, an app concern; on the db service it was a no-op, so the app never
  received it and cookies were always non-secure. Set COOKIE_SECURE=true behind
  a TLS-terminating reverse proxy (Caddy/nginx/traefik), where the app speaks
  plain HTTP internally.
- Image reference unchanged: ${IMAGE_TAG:-latest} (no hardcoded version).

docker-compose.yml

@@ -1,5 +1,3 @@
-version: "3.8"
-
 services:
   # PostgreSQL Database
   db:
@@ -9,7 +7,6 @@ services:
       POSTGRES_DB: bookhoard
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: ${DBPASS}
-      COOKIE_SECURE: false # make true in production with HTTPS
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./database/schema:/docker-entrypoint-initdb.d
@@ -47,7 +44,9 @@ services:
       # Local: http://localhost:8765
       # Local network: http://192.168.1.X:8765
       # Domain: https://bookhoard.example.com
-      BASE_URL: http://localhost:${SERVER_PORT}
+      BASE_URL: ${BASE_URL:-http://localhost:8765}
+      # Mark session cookies Secure; set true behind a TLS-terminating reverse proxy (Caddy/nginx/traefik)
+      COOKIE_SECURE: ${COOKIE_SECURE:-false}
 
       # Rate Limiting Configuration
       TEST_MODE: ${TEST_MODE:-false}