docs(config): document and wire OAUTH_ENCRYPTION_KEY and dashboard RabbitMQ credentials

- .env.example: add JWT_SECRET_KEY and OAUTH_ENCRYPTION_KEY to the
  production section with generation instructions; both were absent
  despite being required in production
- docker-compose.prod.yml: pass OAUTH_ENCRYPTION_KEY to the api service
  (introduced in #76 but never wired into the prod overlay); wire
  RABBITMQ_MANAGEMENT_USER/PASSWORD to the dashboard service so it
  uses production RabbitMQ credentials instead of the dev defaults

Refs #69

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: SimplicityGuy

.env.example

@@ -28,6 +28,15 @@ DISCOGS_ROOT=/discogs-data
 # These are only used when running with the production overlay
 # CHANGE THESE VALUES FOR PRODUCTION!
 
+# JWT Secret — shared by api, curator, explore services
+# Generate with: openssl rand -hex 32
+JWT_SECRET_KEY=CHANGE_ME_IN_PRODUCTION
+
+# OAuth encryption key — Fernet symmetric key used to encrypt Discogs consumer keys and OAuth tokens at rest
+# Required in production; if unset, tokens are stored in plaintext
+# Generate with: python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())'
+OAUTH_ENCRYPTION_KEY=CHANGE_ME_IN_PRODUCTION
+
 # RabbitMQ Production
 RABBITMQ_USER=discogsography
 RABBITMQ_PASS=CHANGE_ME_IN_PRODUCTION

docker-compose.prod.yml

@@ -6,7 +6,8 @@
 # Additional environment variables for production:
 # - UID/GID: User/Group ID for container processes (default: 1000)
 # - Memory limits: <SERVICE>_MEMORY_LIMIT (e.g., DASHBOARD_MEMORY_LIMIT)
-# - Database credentials: RABBITMQ_USER, POSTGRES_USER, NEO4J_USER, etc.
+# - Database credentials: RABBITMQ_USER, RABBITMQ_PASS, POSTGRES_USER, NEO4J_USER, etc.
+# - Secrets: JWT_SECRET_KEY, OAUTH_ENCRYPTION_KEY
 
 services:
   rabbitmq:
@@ -35,6 +36,7 @@ services:
     restart: always
     environment:
       JWT_SECRET_KEY: ${JWT_SECRET_KEY}
+      OAUTH_ENCRYPTION_KEY: ${OAUTH_ENCRYPTION_KEY}
       POSTGRES_USER: ${POSTGRES_USER}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
     deploy:
@@ -82,6 +84,9 @@ services:
 
   dashboard:
     restart: always
+    environment:
+      RABBITMQ_MANAGEMENT_USER: ${RABBITMQ_USER}
+      RABBITMQ_MANAGEMENT_PASSWORD: ${RABBITMQ_PASS}
     deploy:
       restart_policy:
         condition: any