Pass the new Pireon variables through Compose

The production stack hands the containers only the variables it lists,
and PIREON_REDIRECT_CLIENT_ID, its secret, PIREON_REDIRECT_LOGIN and the
two webhook secrets were not among them: set in Dokploy, they never
reached the application, so «Entrar con Pireon» never showed up.

Compose also passes an unset variable as an empty one, so an empty
PIREON_REDIRECT_URI now falls back to APP_URL/auth/callback (the redirect
flow had none otherwise), and an empty PIREON_REDIRECT_LOGIN no longer
hides the button.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/pireon.php

@@ -31,7 +31,8 @@ return [
     | Where the identity server sends the user back after they authorise us.
     | Must match one of the redirect URIs registered for the client.
     */
-    'redirect_uri' => env('PIREON_REDIRECT_URI', env('APP_URL', 'http://localhost').'/auth/callback'),
+    // Compose passes an unset variable as an empty one: empty means default.
+    'redirect_uri' => env('PIREON_REDIRECT_URI') ?: rtrim((string) env('APP_URL', 'http://localhost'), '/').'/auth/callback',
 
     /*
     | The redirect flow («Entrar con Pireon», Authorization Code + PKCE) can
@@ -49,7 +50,9 @@ return [
     | client, and the button would fail with it. Set it to true when the main
     | client allows authorization_code too.
     */
-    'redirect_login' => (bool) (env('PIREON_REDIRECT_LOGIN') ?? filled(env('PIREON_REDIRECT_CLIENT_ID'))),
+    'redirect_login' => filled(env('PIREON_REDIRECT_LOGIN'))
+        ? (bool) env('PIREON_REDIRECT_LOGIN')
+        : filled(env('PIREON_REDIRECT_CLIENT_ID')),
 
     /*
     | Scopes requested for panel sessions. We only ever need to read the

docker-compose.yml

@@ -91,6 +91,13 @@ x-app-env: &app-env
   PIREON_CLIENT_ID: ${PIREON_CLIENT_ID}
   PIREON_CLIENT_SECRET: ${PIREON_CLIENT_SECRET}
   PIREON_REDIRECT_URI: ${PIREON_REDIRECT_URI}
+  # «Entrar con Pireon»: its own authorization_code client (the button shows
+  # up once it is set), and the webhook secret of each client.
+  PIREON_REDIRECT_CLIENT_ID: ${PIREON_REDIRECT_CLIENT_ID:-}
+  PIREON_REDIRECT_CLIENT_SECRET: ${PIREON_REDIRECT_CLIENT_SECRET:-}
+  PIREON_REDIRECT_LOGIN: ${PIREON_REDIRECT_LOGIN:-}
+  PIREON_WEBHOOK_SECRET: ${PIREON_WEBHOOK_SECRET:-}
+  PIREON_REDIRECT_WEBHOOK_SECRET: ${PIREON_REDIRECT_WEBHOOK_SECRET:-}
   PIREON_SCOPES: ${PIREON_SCOPES:-account:read}
   PIREON_PASSWORD_GRANT: ${PIREON_PASSWORD_GRANT:-true}
   PIREON_INTROSPECTION_TTL: ${PIREON_INTROSPECTION_TTL:-60}