Fix Mercure JWT secret mismatch

setup.sh was forcing --env-file ../.env (root .env with placeholder secret)
instead of letting Docker Compose use docker/.env (real secret). Mercure
config now generates the publisher JWT from MERCURE_JWT_SECRET directly,
removing the need for a separate pre-generated token.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/packages/mercure.yaml

@@ -4,4 +4,5 @@ mercure:
             url: '%env(MERCURE_URL)%'
             public_url: '%env(MERCURE_PUBLIC_URL)%'
             jwt:
-                value: '%env(MERCURE_PUBLISHER_JWT_TOKEN)%'
+                secret: '%env(MERCURE_JWT_SECRET)%'
+                publish: ['*']

docker/setup.sh

@@ -28,7 +28,7 @@ else
 fi
 
 # Helper to run docker compose from the docker directory
-dc() { (cd "$DOCKER_DIR" && $DOCKER_COMPOSE -f compose.yaml -f compose.override.yaml --env-file ../.env "$@"); }
+dc() { (cd "$DOCKER_DIR" && $DOCKER_COMPOSE -f compose.yaml -f compose.override.yaml "$@"); }
 
 REBUILD=1
 RECREATE=0