fix(compose): pass BACKUP_KEY through to the server container

The server's compose environment: block is an allowlist — it only forwards the vars
it names. BACKUP_KEY was never added when the backup feature landed, so even though
Komodo wrote BACKUP_KEY into the Stack .env, compose dropped it and the container
came up without it (docker inspect showed JWT/SIGN present, BACKUP_KEY absent — not
empty, absent). The Backup screen correctly reported 'BACKUP_KEY missing'.

Add BACKUP_KEY: ${BACKUP_KEY:-} next to EVENT_SIGNING_KEY (optional, empty default —
backups stay off until it's set). The prod overlay only merges VISION_URL, so the
base addition flows through to prod.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

docker-compose.yml

@@ -24,6 +24,10 @@ services:
       # Dedicated ledger-signing key. Falls back to JWT_SECRET (with a warning) if empty;
       # set a distinct one in prod. See apps/server/.env.example + local-jwt-auth.
       EVENT_SIGNING_KEY: ${EVENT_SIGNING_KEY:-}
+      # Dedicated backup-ENCRYPTION key (separate from the signing key). Empty = backups stay
+      # off (the in-UI target + retention do nothing without it). Per-booth + unique; escrow it
+      # offsite. See apps/server/.env.example + wiki/concepts/backup-recovery.md.
+      BACKUP_KEY: ${BACKUP_KEY:-}
       # CRITICAL on the plain-HTTP booth LAN: cookies are Secure (HTTPS-only) by DEFAULT,
       # so without COOKIE_SECURE=0 the auth cookie is never sent over http and operators
       # CANNOT LOG IN. Leave unset only behind TLS. See disk-os-hardening "deploy-time runbook".