fleet-manager: layer config as defaults.env (committed) + .env (overrides)

Rename .env.example -> defaults.env and make it the committed defaults layer.
Compose reads defaults.env then .env (later wins) via COMPOSE_ENV_FILES, feeding
BOTH container env and ${...} interpolation — so a changed default here reaches
every run without re-copying, and .env shrinks to just overrides + secrets.

No compose service restructure: the existing interpolated environment: blocks
already build the container env; the layering just supplies their values from two
files. (env_file: directive alone wouldn't work — it doesn't feed the image-tag /
cross-service Influx / ACME_EMAIL interpolation this compose relies on.)

Docs (DEPLOY §1, compose header, README) updated: export
COMPOSE_ENV_FILES=defaults.env,.env, keep only secrets/overrides in .env.

serving/fleet-manager/docker-compose.yml

@@ -2,12 +2,16 @@
 # fleet-manager — server-side fleet control plane + admin SPA, plus its private
 # InfluxDB metrics store. Runs on the MANAGEMENT host (never the boot LAN).
 #
-#   cp .env.example .env    # set RP origin, Influx token, cert/PKI paths
+#   export COMPOSE_ENV_FILES=defaults.env,.env   # layer defaults + your overrides
+#   printf 'FLEET_MGR_INFLUX_TOKEN=...\nINFLUX_ADMIN_PASSWORD=...\n' > .env  # secrets/overrides
 #   ./server-pki.sh         # issue the agent-plane server cert (fleet CA)
 #   ../enrol-broker/admin-pki.sh ../dot1x-bench/pki/broker fleet-manager
 #   docker compose up -d influxdb
 #   docker compose run --rm fleet-manager register-admin <you>   # passkey link
-#   docker compose up -d fleet-manager
+#   docker compose up -d fleet-manager traefik
+#
+# Config = defaults.env (committed) + .env (gitignored overrides), layered via
+# COMPOSE_ENV_FILES. Only put overrides + secrets in .env.
 #
 # See DEPLOY.md for the full bring-up (PKI, Let's Encrypt DNS-01, register-admin).
 #