Tag non-production tabs, and drop the FOODSTER_ prefix

With dev and prod open side by side in the same browser, the tabs were
indistinguishable. ENV is written into the title of every page unless it says
prod, so "dev · Foodster" picks itself out. The value is used verbatim, so
ENV=staging labels itself too, and prod and production both count as unmarked
so a stray capital cannot tag the real instance.

Environment variables lose their prefix: PASSWORD, DB, ENV, ADDR, HOST, REPO,
TAG. The container namespaces them already, and this matches how the other
services here are configured.

PUID/PGID are the exception rather than UID/GID. UID is read-only in bash, so
a value set in .env would be silently replaced by the invoking shell's own and
compose's user: would ignore what was asked for.

Breaking for a running instance: the deployed .env has to be rewritten in the
same deploy, or the app will refuse to start on an unset PASSWORD.

README.md

@@ -173,13 +173,19 @@ Everything is environment variables. `.env` is gitignored; start from
 
 | Variable | Default | Purpose |
 |---|---|---|
-| `FOODSTER_PASSWORD` | *required* | Shared password. The app will not start without it. |
-| `FOODSTER_DB` | `./data/foodster.db` | SQLite file path; the directory is created if missing. |
-| `FOODSTER_UID` / `FOODSTER_GID` | `1000` | Host owner of `./data`, for the bind mount. |
+| `PASSWORD` | *required* | Shared password. The app will not start without it. |
+| `DB` | `./data/foodster.db` | SQLite file path; the directory is created if missing. |
+| `ENV` | `prod` | Anything else is prefixed to the tab title (`dev · Foodster`). |
+| `ADDR` | `:8080` | Listen address. Only useful for a second local instance. |
+| `PUID` / `PGID` | `1000` | Host owner of `./data`, for the bind mount. |
 | `TZ` | `Europe/Helsinki` | Used for every calendar-day calculation. |
-| `FOODSTER_REPO` | *required to build* | Image repository, no tag. |
-| `FOODSTER_TAG` | `latest` | Tag to run under compose. |
-| `FOODSTER_PORT` | `8080` | Host port to publish. |
+
+Names carry no prefix: the container gives them their own namespace already.
+`PUID`/`PGID` are the exception — `UID` is read-only in bash, so a value set
+in `.env` would be silently replaced by the invoking shell's own.
+| `REPO` | *required to build* | Image repository, no tag. |
+| `TAG` | `latest` | Tag to run under compose. |
+| `HOST` | *required to run* | Hostname Traefik routes to. |
 
 Set `TZ` in development too. Under UTC the date rolls over three hours late,
 which is exactly when dinner gets logged.
@@ -204,7 +210,7 @@ the container, so a backup is `cp -r data` and you can inspect the file with
 any sqlite client without going through the engine.
 
 That directory must exist and be owned by the user compose runs as — `make up`
-creates it, and `FOODSTER_UID`/`FOODSTER_GID` in `.env` tell the container who
+creates it, and `PUID`/`PGID` in `.env` tell the container who
 that is. Get them from `id -u` and `id -g`.
 
 If the app exits with `cannot open /data/foodster.db ... unable to open
@@ -213,7 +219,7 @@ bind-mount directory as root, and the container is not root:
 
 ```sh
 ls -ldn data                      # whose is it?
-sudo chown -R 1000:1000 data      # match FOODSTER_UID / FOODSTER_GID
+sudo chown -R 1000:1000 data      # match PUID / PGID
 docker compose restart
 ```
 
@@ -235,7 +241,7 @@ counting it would lock the household out for simply opening the app.
 address, meaning it arrived through the proxy. A client connecting directly
 could otherwise forge a new address per attempt and skip the limiter.
 
-**None of this replaces a strong `FOODSTER_PASSWORD`.** Rate limiting removes
+**None of this replaces a strong `PASSWORD`.** Rate limiting removes
 brute force as a practical route; it does not make a guessable password safe.
 
 ## Mockups