Fix Mercure JWT secret mismatch

setup.sh was forcing --env-file ../.env (root .env with placeholder secret)
instead of letting Docker Compose use docker/.env (real secret). Mercure
config now generates the publisher JWT from MERCURE_JWT_SECRET directly,
removing the need for a separate pre-generated token.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/packages/mercure.yaml

@@ -4,4 +4,5 @@ mercure:
             url: '%env(MERCURE_URL)%'
             public_url: '%env(MERCURE_PUBLIC_URL)%'
             jwt:
-                value: '%env(MERCURE_PUBLISHER_JWT_TOKEN)%'
+                secret: '%env(MERCURE_JWT_SECRET)%'
+                publish: ['*']