Lef-F cuts Mike loose from the cloud

- scripts/generate-secrets.sh: strip inline comments from .env values
  so GARAGE_RPC_SECRET (and others) are correctly detected as empty and
  regenerated on first run
- docker/init-garage.Dockerfile: new multi-stage image that copies
  /garage binary into alpine, replacing the shell-less scratch image
  that had no /bin/sh
- docker-compose.yml: change init-garage to use alpine:3.20 directly
  (garage CLI no longer needed; init script now calls HTTP admin API);
  add API_EXTERNAL_URL env var required by GoTrue v2
- docker/init-garage.sh: rewrite to use Garage v2 HTTP admin API
  (port 3903) instead of the RPC CLI, which required the server's node
  key; fixes both first-boot and idempotent restart; corrects endpoint
  names (GetKeyInfo, not GetKey; ListKeys for existence check)

The backend's @supabase/supabase-js client constructs URLs as
${SUPABASE_URL}/auth/v1/..., so SUPABASE_URL must point at a layer
that strips /auth/v1/ before forwarding to GoTrue (which serves at
the root path). Pointing it at gotrue:9999 directly returned 404
on every auth call, causing all backend endpoints to return 401.

Two changes:
- Caddy site address relaxed from {$MIKE_HOST}:{$MIKE_PORT} to
  :{$MIKE_PORT} so internal services (caddy:80) reach it without
  Host-header matching games.
- reverse_proxy directives set 'header_up Host {upstream_hostport}'
  so Caddy presents the upstream's address as the Host header instead
  of forwarding the inbound Host through, which was causing GoTrue
  to return empty 200 responses for in-cluster requests.
- mike-backend SUPABASE_URL now points at http://caddy:${MIKE_PORT}.

The AWS S3 SDK uses virtual-hosted-style URLs by default
(<bucket>.<endpoint>), so it tries to resolve 'mike.garage:3900'
when uploading to the 'mike' bucket via http://garage:3900.

Three changes:
- docker-compose.yml: add a network alias 'mike.garage' on the
  garage service so the SDK's hostname resolves.
- garage.toml: set s3_region = 'auto' to match the value Mike's
  storage.ts hardcodes when constructing the S3 client (Garage
  rejects requests whose AWS4 scope doesn't match its region).
- garage.toml: set root_domain = '.garage' so Garage parses the
  bucket name out of the inbound Host header for virtual-hosted
  requests.

Tied to R2_BUCKET_NAME=mike. If you rename the bucket, update
the alias in docker-compose.yml to match.

Drops mike-frontend image from 1.98 GB to ~465 MB (76% reduction)
by relying on Next.js's standalone output mode. Standalone bundles
only the node_modules subset the server actually requires at runtime
instead of copying the whole build-stage tree (which still contains
devDeps after npm ci).

Two changes:
- frontend/next.config.ts: add output: 'standalone'.
- docker/frontend.Dockerfile: runtime stage now copies .next/standalone
  + .next/static + public, and runs 'node server.js' instead of
  'npm run start'.

The standalone server still picks up the NEXT_PUBLIC_* values that
were baked at build time, so behaviour is unchanged.

Adds the :- empty-default substitution to ANTHROPIC_API_KEY and
GEMINI_API_KEY so docker compose treats them as optional. The .env.example
default is the empty string but a user that wipes one of them (e.g. only
sets GEMINI_API_KEY) was getting a 'variable is not set' warning on every
compose invocation. Cosmetic, but loud enough to bury real warnings.

Two cleanups surfaced by the final code review:

- Caddy's site address was relaxed from {$MIKE_HOST}:{$MIKE_PORT} to
  :{$MIKE_PORT} in 9cc8453, but the compose service kept passing
  MIKE_HOST: ${MIKE_HOST} into the container env. The variable is no
  longer read by the Caddyfile; replace with a comment explaining
  where MIKE_HOST is actually consumed (frontend build args + GoTrue
  allow-list) so future maintainers don't assume it flows here.

- docker/init-garage.Dockerfile was created as part of 9613b6b's first
  bootstrap attempt; the same commit pivoted init-garage to use
  alpine:3.20 + Garage's HTTP admin API and the Dockerfile became
  unreferenced. Delete it to avoid misleading future edits.

PostgREST is configured with PGRST_JWT_AUD: authenticated. The anon
and service_role JWTs minted by generate-secrets.sh had no aud claim
at all. PostgREST currently accepts a missing aud as a soft-pass
under our config - the smoke test exercised this path and got 200 -
but that is brittle library behaviour and would change between
PostgREST major versions.

Add "aud":"authenticated" to the JWT payload so the audience check
is explicit. GoTrue-issued user JWTs already carry this claim, so
the publishable/secret JWTs now match the user-session shape.

HMAC signing is unchanged. Existing .env files keep working with
their current keys; users who want the new form run
./scripts/generate-secrets.sh --force.