fix: bake DDNS_TOTP_SECRET and correct URL into defaults

docker-compose.yml DDNS_TOTP_SECRET defaulted to empty string —
containers on fresh installs had no OTP, so every /register call
was rejected with 401 and no domain was ever registered.

setup_cell.py still pointed to https://ddns.pic.ngo/api/v1 (no nginx
on VPS, so HTTPS fails). Both now default to the correct values; both
are still overridable via env var for custom DDNS deployments.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/setup_cell.py

@@ -268,7 +268,7 @@ def ensure_session_secret():
     print('[CREATED] data/api/.session_secret')
 
 
-DDNS_URL         = os.environ.get('DDNS_URL',             'https://ddns.pic.ngo/api/v1')
+DDNS_URL         = os.environ.get('DDNS_URL',             'http://ddns.pic.ngo:8080/api/v1')
 DDNS_TOTP_SECRET = os.environ.get('DDNS_TOTP_SECRET',    'S6UMA464YIKM74QHXWL5WELDIO3HFZ6K')
 DOMAIN_MODE      = os.environ.get('DOMAIN_MODE',          'pic_ngo')
 CELL_DOMAIN_NAME = os.environ.get('CELL_DOMAIN_NAME',     '')