fix: API key save network error — add ENCRYPTION_KEY env and auto-migrate

The "Netzwerkfehler beim Speichern des Schlüssels" was caused by two issues:
1. ENCRYPTION_KEY env var was not passed to the Docker container, so
   AES-256-GCM encrypt() threw at runtime on every POST/PATCH.
2. The 0003_tenant_api_keys migration was not in the drizzle journal
   and no migration runner existed in the Docker image.

Changes:
- docker-compose.yml: pass ENCRYPTION_KEY to app container
- .env.example: document ENCRYPTION_KEY with generation command
- .gitignore: allow .env.example to be tracked
- Dockerfile: include drizzle/ migrations and entrypoint script
- entrypoint.sh: run migrations before starting the app
- migrate.mjs: runtime migration script using drizzle-orm migrator
- drizzle journal: register 0003_tenant_api_keys migration

Co-Authored-By: Paperclip <noreply@paperclip.ing>

drizzle/meta/_journal.json

@@ -22,6 +22,13 @@
       "when": 1775729813628,
       "tag": "0002_wide_grandmaster",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1775775900000,
+      "tag": "0003_tenant_api_keys",
+      "breakpoints": true
     }
   ]
 }