Remove hardcoded JWT/session secrets from docker-compose

[Copilot]

A real 64-byte JWT secret and a hardcoded SESSION_SECRET were committed directly in docker-compose.yml, exposing them to anyone with repo access.

Changes

• docker-compose.yml: Replace hardcoded JWT_SECRET across all 5 services (auth-service, landing-page, hello-world-app, hearts-game-service, training-peaks-service) with ${JWT_SECRET}. Remove SESSION_SECRET entirely — no service reads it at runtime (auth-service uses an internal hardcoded string for its short-lived OAuth state session only).
• .env.example: Document JWT_SECRET as required, with generation instructions (openssl rand -hex 64). Add missing POSTGRES_DB/USER/PASSWORD vars. Drop SESSION_SECRET.

# Before
- JWT_SECRET=7aa5c54ef4656dc9141d86d0448995227515021093db7bad9c10a085bef3b00fab31da0e2bdde0a55b481a66f233127f3c74eeb9cb035595bbfa6f5e478795fd
- SESSION_SECRET=dev-secret-key-change-in-production

# After
- JWT_SECRET=${JWT_SECRET}

The .env file is already git-ignored; operators need to create one with a generated secret.