chore: pin compose project and pass server token from .env

[flexdinesh]

• Behavior owner and resulting change:
  • compose.yaml pins the project name to diffx, so the data volume is shared by every checkout and -p diffx is no longer needed.
  • It forwards DIFFX_SERVER_TOKEN, so a .env beside compose.yaml can set the bootstrap credential. Empty or unset keeps the generated token.
  • .gitignore ignores .env, so a real token is never committed. The Docker build context already excluded it.
• Contracts/invariants affected; local/remote implications:
  • The server still never replaces a persisted credential. A different token for an existing account fails startup, as documented.
  • The volume name is now diffx_diffx-data. Stacks started from a checkout without -p diffx used <dir>_diffx-data; move or recreate that data if needed.
• Validation results; remaining risks:
  • docker compose config resolves the token from .env.
  • In a throwaway stack with a .env token, health returned 200 with that token and 401 with a wrong one.
  • Pre-push check:push passed.
• Intentional architecture/design changes and rationale (if any): none.
• UI evidence: n/a.