serving: defaults.env header + Makefile + .gitignore + doc refs

Completes the rename commit (which carried only the file move): defaults.env
layering header, docker-compose usage comment, serving/Makefile (sets
COMPOSE_ENV_FILES), serving/.gitignore (.env), and the README/TODO references.

serving/defaults.env

@@ -1,4 +1,16 @@
-# Copy to .env and edit for your test LAN/bridge, then: docker compose up -d
+# defaults.env — the COMMITTED default configuration for the serving stack.
+#
+# Compose LAYERS this file, then .env (overrides), for both container env AND
+# ${...} interpolation. Enable the layering once per shell (later file wins):
+#
+#   export COMPOSE_ENV_FILES=defaults.env,.env
+#   # or per command:  docker compose --env-file defaults.env --env-file .env <cmd>
+#   # or just use the Makefile: `make up` / `make logs` (sets it for you)
+#
+# Then put ONLY per-environment overrides + secrets in .env (gitignored) — at
+# least BOOT_IFACE / SERVER_IP / DHCP range / IMAGE_VERSION for your LAN. Changing
+# a default here reaches every run without anyone re-copying it. (.env must exist
+# when COMPOSE_ENV_FILES lists it; create it with at least those overrides.)
 
 # Release being served. Must match the Packer build (fleet-<version>.efi).
 IMAGE_VERSION=0.0.0-2eefd97