Tag non-production tabs, and drop the FOODSTER_ prefix

With dev and prod open side by side in the same browser, the tabs were
indistinguishable. ENV is written into the title of every page unless it says
prod, so "dev · Foodster" picks itself out. The value is used verbatim, so
ENV=staging labels itself too, and prod and production both count as unmarked
so a stray capital cannot tag the real instance.

Environment variables lose their prefix: PASSWORD, DB, ENV, ADDR, HOST, REPO,
TAG. The container namespaces them already, and this matches how the other
services here are configured.

PUID/PGID are the exception rather than UID/GID. UID is read-only in bash, so
a value set in .env would be silently replaced by the invoking shell's own and
compose's user: would ignore what was asked for.

Breaking for a running instance: the deployed .env has to be rewritten in the
same deploy, or the app will refuse to start on an unset PASSWORD.

compose.yaml

@@ -1,19 +1,23 @@
 services:
   app:
-    image: ${FOODSTER_REPO:?set FOODSTER_REPO in .env}:${FOODSTER_TAG:-latest}
+    image: ${REPO:?set REPO in .env}:${TAG:-latest}
     restart: unless-stopped
 
-    # The database is a bind mount, not a named volume: it sits in ./data on
-    # the host where it can be listed, copied and opened with any sqlite
-    # client. The image runs as UID 65534, so the container has to be told
-    # which host user owns that directory.
-    user: "${FOODSTER_UID:-1000}:${FOODSTER_GID:-1000}"
+    # A bind mount rather than a named volume: the database sits in ./data on
+    # the host, where it can be listed, copied and backed up without going
+    # through the container engine. The image runs as UID 65534, so the
+    # container has to be told which host user owns that directory.
+    #
+    # PUID/PGID rather than UID/GID: UID is a read-only variable in bash, so a
+    # value set here would be silently replaced by the invoking shell's own.
+    user: "${PUID:-1000}:${PGID:-1000}"
     volumes:
       - ./data:/data
 
     environment:
-      FOODSTER_PASSWORD: ${FOODSTER_PASSWORD:?set FOODSTER_PASSWORD in .env}
-      FOODSTER_DB: /data/foodster.db
+      PASSWORD: ${PASSWORD:?set PASSWORD in .env}
+      DB: /data/foodster.db
+      ENV: ${ENV:-prod}
       TZ: ${TZ:-Europe/Helsinki}
 
     # No published ports: Traefik reaches the container over the shared
@@ -22,7 +26,7 @@ services:
     labels:
       - traefik.enable=true
       - traefik.http.routers.foodster.entrypoints=websecure
-      - traefik.http.routers.foodster.rule=Host(`${FOODSTER_HOST:?set FOODSTER_HOST in .env}`)
+      - traefik.http.routers.foodster.rule=Host(`${HOST:?set HOST in .env}`)
       - traefik.http.routers.foodster.tls=true
       - traefik.http.services.foodster.loadbalancer.server.port=8080
       - traefik.docker.network=traefik