DOCKER: Add INTERNAL_AUTH_TOKEN support and improve auto-generation

- Add INTERNAL_AUTH_TOKEN to docker-compose.yml environment variables
- Create comprehensive .env.example with deployment guidance
- Document zero-config deployment for single instances
- Clarify multi-instance deployment requirements
- Ensure auto-generated keys persist in Docker volumes (/app/config)

Security improvements:
- Complete Docker support for new internal auth token mechanism
- Maintains automatic key generation while ensuring persistence
- No manual configuration required for standard deployments

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

docker/docker-compose.yml

@@ -1,3 +1,12 @@
+# Termix Docker Compose Configuration
+#
+# QUICK START: Just run "docker-compose up -d"
+# - Security keys are auto-generated on first startup
+# - Keys are persisted in Docker volumes (survive container restarts)
+# - No manual .env file needed for single-instance deployment
+#
+# See docker/.env.example for advanced configuration options
+
 services:
   termix:
     build:
@@ -12,7 +21,7 @@ services:
       - "${SSL_PORT:-8443}:8443"
     volumes:
       - termix-data:/app/data
-      - termix-config:/app/config
+      - termix-config:/app/config  # Auto-generated .env keys are persisted here
       # Optional: Mount custom SSL certificates
       # - ./ssl:/app/ssl:ro
     environment:
@@ -27,9 +36,12 @@ services:
       - SSL_CERT_PATH=${SSL_CERT_PATH:-/app/ssl/termix.crt}
       - SSL_KEY_PATH=${SSL_KEY_PATH:-/app/ssl/termix.key}
 
-      # Security keys (set these for production)
+      # Security keys (auto-generated if not provided)
+      # Leave empty to auto-generate secure random keys on first startup
+      # Set values only if you need specific keys for multi-instance deployment
       - JWT_SECRET=${JWT_SECRET:-}
       - DATABASE_KEY=${DATABASE_KEY:-}
+      - INTERNAL_AUTH_TOKEN=${INTERNAL_AUTH_TOKEN:-}
 
       # Database configuration
       - DATABASE_ENCRYPTION=${DATABASE_ENCRYPTION:-true}