Make docker-compose.yml deployable as-is on the production server

Adds image: alongside build: so `docker compose build && push` works
locally, while the server can just `docker compose pull && up -d`
without needing the Dockerfile/build context. .env.example now
documents each variable and adds HOST_PORT.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -1,3 +1,16 @@
+# Copy this file to .env and fill in real values.
+# .env is gitignored — never commit it.
+
+# Password to log into /admin. Change this to something you'd actually use.
 ADMIN_PASSWORD=change-me
+
+# Random string used to sign session cookies. Generate one with:
+#   python3 -c "import secrets; print(secrets.token_hex(32))"
 SECRET_KEY=change-me-to-a-long-random-string
+
+# Keep "true" in production (TLS terminated by a reverse proxy in front, e.g. Pangolin).
+# Only set to "false" for local testing without any TLS in front.
 COOKIE_SECURE=true
+
+# Local port the site is reachable on (http://localhost:<HOST_PORT>).
+HOST_PORT=8080