Make docker-compose.yml deployable as-is on the production server

Adds image: alongside build: so `docker compose build && push` works
locally, while the server can just `docker compose pull && up -d`
without needing the Dockerfile/build context. .env.example now
documents each variable and adds HOST_PORT.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -1,3 +1,16 @@
+# Copy this file to .env and fill in real values.
+# .env is gitignored — never commit it.
+
+# Password to log into /admin. Change this to something you'd actually use.
 ADMIN_PASSWORD=change-me
+
+# Random string used to sign session cookies. Generate one with:
+#   python3 -c "import secrets; print(secrets.token_hex(32))"
 SECRET_KEY=change-me-to-a-long-random-string
+
+# Keep "true" in production (TLS terminated by a reverse proxy in front, e.g. Pangolin).
+# Only set to "false" for local testing without any TLS in front.
 COOKIE_SECURE=true
+
+# Local port the site is reachable on (http://localhost:<HOST_PORT>).
+HOST_PORT=8080

docker-compose.yml

@@ -1,8 +1,13 @@
 services:
   honey-links:
+    # image: used when pulling on the server (docker compose pull && up -d).
+    # build: lets `docker compose build` / `docker compose push` create and
+    #        publish that same image locally, instead of manual docker
+    #        build/tag/push commands.
+    image: gitea.honeyy.duckdns.org/website/honey-links:latest
     build: .
     ports:
-      - "8080:80"
+      - "${HOST_PORT:-8080}:80"
     environment:
       - ADMIN_PASSWORD=${ADMIN_PASSWORD}
       - SECRET_KEY=${SECRET_KEY}