Make CRON_SECRET optional; fix docker env validation failure

CRON_SECRET was required (min 32 chars) in production by env.js, but
neither docker-compose.yml nor docker-compose.coolify.yml passed it
through. Since the release container isn't covered by
SKIP_ENV_VALIDATION (build-stage only), bun run start failed env
validation on every docker deploy unless CRON_SECRET was manually
configured — even though it only gates the optional recurring-invoice
cron endpoint, which already handles being unset gracefully.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.coolify.yml

@@ -32,6 +32,7 @@ services:
       NEXT_PUBLIC_UMAMI_SCRIPT_URL: ${NEXT_PUBLIC_UMAMI_SCRIPT_URL:-https://analytics.umami.is/script.js}
       NEXT_PUBLIC_AUTHENTIK_ENABLED: ${NEXT_PUBLIC_AUTHENTIK_ENABLED:-false}
       DISABLE_SIGNUPS: ${DISABLE_SIGNUPS:-true}
+      CRON_SECRET: ${CRON_SECRET:-}
       AUTHENTIK_ISSUER: ${AUTHENTIK_ISSUER:-}
       AUTHENTIK_CLIENT_ID: ${AUTHENTIK_CLIENT_ID:-}
       AUTHENTIK_CLIENT_SECRET: ${AUTHENTIK_CLIENT_SECRET:-}

docker-compose.yml

@@ -31,6 +31,7 @@ services:
       NEXT_PUBLIC_UMAMI_SCRIPT_URL: ${NEXT_PUBLIC_UMAMI_SCRIPT_URL:-https://analytics.umami.is/script.js}
       NEXT_PUBLIC_AUTHENTIK_ENABLED: ${NEXT_PUBLIC_AUTHENTIK_ENABLED:-false}
       DISABLE_SIGNUPS: ${DISABLE_SIGNUPS:-true}
+      CRON_SECRET: ${CRON_SECRET:-}
       AUTHENTIK_ISSUER: ${AUTHENTIK_ISSUER:-}
       AUTHENTIK_CLIENT_ID: ${AUTHENTIK_CLIENT_ID:-}
       AUTHENTIK_CLIENT_SECRET: ${AUTHENTIK_CLIENT_SECRET:-}

src/env.js

@@ -34,10 +34,10 @@ export const env = createEnv({
       .default("development"),
     DB_DISABLE_SSL: optionalEnvBoolean(),
     DISABLE_SIGNUPS: optionalEnvBoolean().default(true),
-    CRON_SECRET:
-      process.env.NODE_ENV === "production"
-        ? z.string().min(32)
-        : z.string().optional(),
+    // Optional — only gates POST /api/cron/generate-recurring; the route itself
+    // returns a clean error when unset, so deployments that don't use recurring
+    // invoices don't need to configure it.
+    CRON_SECRET: z.string().min(32).optional(),
     // S3-compatible object storage (optional — local .data/receipts/ fallback when unset)
     S3_ENDPOINT: z.string().url().optional(),
     S3_BUCKET: z.string().optional(),