setup.sh was forcing --env-file ../.env (root .env with placeholder secret) instead of letting Docker Compose use docker/.env (real secret). Mercure config now generates the publisher JWT from MERCURE_JWT_SECRET directly, removing the need for a separate pre-generated token. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>