Compose does not forward published .env security settings into API containers #1600

The documented root .env security settings are not forwarded into the service containers by the root Docker Compose deployment. Docker Compose reads .env for interpolation, but these settings are absent from the service environment maps and there is no env_file forwarding.

Reproduction

At source commit 2df0cded2d3d8c96db14498fd5f385fb263b24d3, run:

$config = docker compose --env-file .env.example config --format json | ConvertFrom-Json
$apiNames = $config.services.api.environment.psobject.Properties.Name
$apiNames -contains 'CONDUIT_CORE_SECURITY_HEADERS_ENABLED'
$apiNames -contains 'CONDUIT_CORE_RATE_LIMITING_ENABLED'
@($apiNames | Where-Object { $_ -like 'CONDUIT_CORE_*' }).Count
$config.services.admin.environment.CONDUIT_ADMIN_IP_BANNING_ENABLED

Observed: False, False, 0, and false. Only named security keys were inspected; unrelated configuration values were not printed.

The root .env.example publishes Admin IP banning as enabled and publishes Gateway aggregate/rate-limit settings. The Compose configuration omits the Gateway settings and hardcodes Admin IP banning to false.

This means fixing the application binding in #1596 still does not let an operator change Gateway headers through the advertised .env + Compose workflow. Similar omissions affect the other published security switches and limit values.

Expected change

• Forward supported deployment security variables with documented defaults and explicit interpolation, avoiding blanket injection of unrelated secrets.
• Ensure nondefault values in the root .env reach the intended API container.
• Add a Compose contract check that inspects only the relevant security keys and verifies canonical variables and any supported legacy aliases.
• Reconcile the Admin IP-banning default between the template and Compose.

Found while investigating #1596. Searches across open and closed issues for security + compose, environment + forward, and .env + security found no matching issue. #1592 and #1596 concern application binding; this issue concerns container environment injection.