fix: bake DDNS_TOTP_SECRET and correct URL into defaults

docker-compose.yml DDNS_TOTP_SECRET defaulted to empty string —
containers on fresh installs had no OTP, so every /register call
was rejected with 401 and no domain was ever registered.

setup_cell.py still pointed to https://ddns.pic.ngo/api/v1 (no nginx
on VPS, so HTTPS fails). Both now default to the correct values; both
are still overridable via env var for custom DDNS deployments.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -206,7 +206,7 @@ services:
       - "127.0.0.1:${API_PORT:-3000}:3000"
     environment:
       - DDNS_URL=${DDNS_URL:-http://ddns.pic.ngo:8080/api/v1}
-      - DDNS_TOTP_SECRET=${DDNS_TOTP_SECRET:-}
+      - DDNS_TOTP_SECRET=${DDNS_TOTP_SECRET:-S6UMA464YIKM74QHXWL5WELDIO3HFZ6K}
     volumes:
       - ./data/api:/app/data
       - ./data/dns:/app/data/dns

scripts/setup_cell.py

@@ -268,7 +268,7 @@ def ensure_session_secret():
     print('[CREATED] data/api/.session_secret')
 
 
-DDNS_URL         = os.environ.get('DDNS_URL',             'https://ddns.pic.ngo/api/v1')
+DDNS_URL         = os.environ.get('DDNS_URL',             'http://ddns.pic.ngo:8080/api/v1')
 DDNS_TOTP_SECRET = os.environ.get('DDNS_TOTP_SECRET',    'S6UMA464YIKM74QHXWL5WELDIO3HFZ6K')
 DOMAIN_MODE      = os.environ.get('DOMAIN_MODE',          'pic_ngo')
 CELL_DOMAIN_NAME = os.environ.get('CELL_DOMAIN_NAME',     '')