fix: docker-compose.dev.yml remove env overrides that clobber .env.dev values
environment: block vars override env_file: vars for same-name variables.
Removed JWT_SECRET, JWT_EXPIRES_IN, API_PORT, UPLOAD_DIR, MAX_FILE_SIZE_MB,
RESEND_API_KEY from environment block so .env.dev values are used instead.
This ensures api-dev uses the dev-specific JWT_SECRET (matching the dev
frontend cookie) and correct dev database URL.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>