fix: remove hardcoded secrets from docker-compose, use env vars + profiles

- Remove hardcoded OpenRouter API key and URL from docker-compose.yml
- App service now reads OPENAI_* vars from .env file (env_file) and
  falls back to http://ollama:11434/v1 defaults
- Ollama and model-init moved to 'ollama' Docker Compose profile,
  so they only start when explicitly requested:
    docker compose --profile ollama up      # with local Ollama
    docker compose up                         # cloud provider only
- Port mapping uses 5656 from .env
- .env.docker updated with documented options for Ollama vs OpenRouter

docker-compose.yml

@@ -1,6 +1,8 @@
 services:
   ollama:
     image: ollama/ollama:latest
+    profiles:
+      - ollama
     container_name: english-styler-ollama
     ports:
       - "11434:11434"
@@ -16,6 +18,8 @@ services:
 
   model-init:
     image: ollama/ollama:latest
+    profiles:
+      - ollama
     container_name: english-styler-model-init
     depends_on:
       ollama:
@@ -34,14 +38,14 @@ services:
     build: .
     container_name: english-styler-app
     ports:
-      - "5656:3000"
+      - "${APP_PORT:-5656}:3000"
-    depends_on:
+    env_file:
-      model-init:
+      - path: .env
-        condition: service_completed_successfully
+        required: false
     environment:
-      OPENAI_BASE_URL: http://ollama:11434/v1
+      OPENAI_BASE_URL: ${OPENAI_BASE_URL:-http://ollama:11434/v1}
-      OPENAI_API_KEY: ollama
+      OPENAI_API_KEY: ${OPENAI_API_KEY:-ollama}
-      OPENAI_MODEL: ${OLLAMA_MODEL:-llama3}
+      OPENAI_MODEL: ${OPENAI_MODEL:-llama3}
     restart: unless-stopped
 
 volumes: