feat(services): env doctor — surface empty vars, bad refs, unreadable secrets

GET /services/:id/env-check (read scope) reports, without exposing values:
- unresolved: ${{service.KEY}} refs that don't match a sibling service/env
- empty: variables with blank values
- unreadable: secrets whose ciphertext fails decryption (key rotation)

install.sh now generates SECRETS_KEY explicitly (was falling back to
JWT_SECRET — a rotation would orphan ciphertext). .env.example documents it.

Surfaces: CLI `services env-check`, MCP containr_services_env_check
(90 tools), OpenAPI path, and a warning banner in the service Variables
panel listing each issue.

Verified live: injected a bogus ${{nosuchservice.PORT}} var plus an
unreadable ciphertext row; the endpoint flagged both, ok=false.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

install.sh

@@ -73,6 +73,7 @@ else
     PG_PASS="$(gen)"; REDIS_PASS="$(gen)"
     setvar ENVIRONMENT "production"
     setvar JWT_SECRET "$(gen)"
+    setvar SECRETS_KEY "$(gen)"
     setvar BETTER_AUTH_SECRET "$(gen)"
     setvar BETTER_AUTH_INTERNAL_TOKEN "$(gen)"
     setvar CONTAINR_AGENT_AUTH_TOKEN "$(gen)"