fix(penpot): correct port mappings, healthchecks, and feature flags

- Fix frontend port mapping (8080, not 80)
- Fix healthcheck endpoints to use /readyz
- Add secret key to exporter service
- Disable email verification (no SMTP configured)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

stacks/penpot.yml

@@ -18,14 +18,14 @@ services:
     restart: unless-stopped
 
     ports:
-      - "9001:80"
+      - "9001:8080"
 
     volumes:
       - /home/jpmschweitzer/docker-data/penpot/assets:/opt/data/assets
 
     environment:
       # Feature flags
-      PENPOT_FLAGS: enable-login-with-oidc disable-login-with-password disable-registration enable-oidc-registration
+      PENPOT_FLAGS: enable-login-with-oidc disable-login-with-password disable-registration enable-oidc-registration disable-email-verification
 
       # Backend connection (internal DNS)
       PENPOT_BACKEND_URI: http://penpot-backend:6060
@@ -45,7 +45,7 @@ services:
       - "com.centurylinklabs.watchtower.enable=true"
 
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:80"]
+      test: ["CMD", "curl", "-f", "http://localhost:8080"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -68,7 +68,7 @@ services:
       PENPOT_PUBLIC_URI: https://penpot.schweitz.net
 
       # Feature flags (same as frontend)
-      PENPOT_FLAGS: enable-login-with-oidc disable-login-with-password disable-registration enable-oidc-registration enable-smtp
+      PENPOT_FLAGS: enable-login-with-oidc disable-login-with-password disable-registration enable-oidc-registration disable-email-verification
 
       # PostgreSQL (shared)
       PENPOT_DATABASE_URI: postgresql://postgres-shared:5432/penpot
@@ -120,7 +120,7 @@ services:
       - "com.centurylinklabs.watchtower.enable=true"
 
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:6060/api/health"]
+      test: ["CMD", "curl", "-f", "http://localhost:6060/readyz"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -149,6 +149,9 @@ services:
       # Redis (shared, DB 10)
       PENPOT_REDIS_URI: redis://redis-shared:6379/10
 
+      # Secret key (must match backend)
+      PENPOT_SECRET_KEY: +g+fSbAzBWVA2gE8ZnJUcpgq9L1BCqtuB+h9w73iF9qcgxhjMF1QU23XUjQ5ZdxpPmwoyuuQEm/frtKUV2M6pA==
+
       # Timezone
       TZ: Europe/Amsterdam
 
@@ -159,7 +162,7 @@ services:
       - "com.centurylinklabs.watchtower.enable=true"
 
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:6061"]
+      test: ["CMD", "curl", "-f", "http://localhost:6061/readyz"]
       interval: 30s
       timeout: 10s
       retries: 3