Pass the new Pireon variables through Compose

The production stack hands the containers only the variables it lists,
and PIREON_REDIRECT_CLIENT_ID, its secret, PIREON_REDIRECT_LOGIN and the
two webhook secrets were not among them: set in Dokploy, they never
reached the application, so «Entrar con Pireon» never showed up.

Compose also passes an unset variable as an empty one, so an empty
PIREON_REDIRECT_URI now falls back to APP_URL/auth/callback (the redirect
flow had none otherwise), and an empty PIREON_REDIRECT_LOGIN no longer
hides the button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -91,6 +91,13 @@ x-app-env: &app-env
   PIREON_CLIENT_ID: ${PIREON_CLIENT_ID}
   PIREON_CLIENT_SECRET: ${PIREON_CLIENT_SECRET}
   PIREON_REDIRECT_URI: ${PIREON_REDIRECT_URI}
+  # «Entrar con Pireon»: its own authorization_code client (the button shows
+  # up once it is set), and the webhook secret of each client.
+  PIREON_REDIRECT_CLIENT_ID: ${PIREON_REDIRECT_CLIENT_ID:-}
+  PIREON_REDIRECT_CLIENT_SECRET: ${PIREON_REDIRECT_CLIENT_SECRET:-}
+  PIREON_REDIRECT_LOGIN: ${PIREON_REDIRECT_LOGIN:-}
+  PIREON_WEBHOOK_SECRET: ${PIREON_WEBHOOK_SECRET:-}
+  PIREON_REDIRECT_WEBHOOK_SECRET: ${PIREON_REDIRECT_WEBHOOK_SECRET:-}
   PIREON_SCOPES: ${PIREON_SCOPES:-account:read}
   PIREON_PASSWORD_GRANT: ${PIREON_PASSWORD_GRANT:-true}
   PIREON_INTROSPECTION_TTL: ${PIREON_INTROSPECTION_TTL:-60}