Fix/remove docker secrets

[wonderofme]

Description

During a security audit, I identified a High-Severity vulnerability where production secrets were hardcoded directly into workflow/docker-compose.yml.

Vulnerability:
The following sensitive credentials were exposed in plain text:

• POSTGRES_PASSWORD
• JWT_SECRET (Critical for session security)
• ENCRYPTION_KEY
• OAuth Client Secrets (Google, AIxBlock)

Impact:
Any user who clones this repository receives these keys. If this configuration is deployed to production (as the docker-compose filename suggests), the application is immediately compromised. Attackers could forge session tokens (JWT_SECRET) or access the database directly (POSTGRES_PASSWORD).

The Fix:
I have removed all hardcoded values and replaced them with environment variable references (e.g., ${POSTGRES_PASSWORD}). This forces the administrator to provide these secrets securely via a .env file or the environment, following the 12-Factor App security principles.

Type of Change

• Security Patch