feat(services): env doctor — surface empty vars, bad refs, unreadable secrets

GET /services/:id/env-check (read scope) reports, without exposing values:
- unresolved: ${{service.KEY}} refs that don't match a sibling service/env
- empty: variables with blank values
- unreadable: secrets whose ciphertext fails decryption (key rotation)

install.sh now generates SECRETS_KEY explicitly (was falling back to
JWT_SECRET — a rotation would orphan ciphertext). .env.example documents it.

Surfaces: CLI `services env-check`, MCP containr_services_env_check
(90 tools), OpenAPI path, and a warning banner in the service Variables
panel listing each issue.

Verified live: injected a bogus ${{nosuchservice.PORT}} var plus an
unreadable ciphertext row; the endpoint flagged both, ok=false.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/api/openapi.yaml

@@ -685,6 +685,41 @@ paths:
         '202':
           description: Wake initiated
 
+  /services/{id}/env-check:
+    get:
+      tags:
+        - Services
+      summary: Environment diagnostics
+      description: Reports empty variables, unresolved ${{service.KEY}} references, and secrets whose stored ciphertext fails to decrypt. Values are never returned.
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Diagnostic result
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  ok:
+                    type: boolean
+                  unresolved:
+                    type: array
+                    items:
+                      type: string
+                  empty:
+                    type: array
+                    items:
+                      type: string
+                  unreadable:
+                    type: array
+                    items:
+                      type: string
+
   /internal/wake/{id}:
     get:
       tags:

docs/guides/CLI.md

@@ -168,6 +168,7 @@ containr services update <id> --sleep --sleep-idle 15   # enable, 15 min idle ti
 containr services update <id> --sleep=false            # disable
 containr services sleep <id>                           # sleep now
 containr services wake <id>                            # resume now
+containr services env-check <id>                      # flag empty vars + unresolved ${{refs}}
 ```
 
 Idleness is measured as flat container network I/O over the configured