Fix Docker runtime: secure cookies over HTTP and empty env vars

- useSecureCookies now keys off the BETTER_AUTH_URL scheme instead of
  NODE_ENV, so login works over http://localhost in the (production-mode)
  Docker stack instead of the browser silently dropping the session cookie.
- env parsing treats empty strings as unset, so compose-supplied optionals
  like `SMTP_PORT=` no longer fail coercion (Number("") === 0) and crash boot.
- docker-compose: configurable host Postgres port (POSTGRES_PORT) to avoid
  clashing with an existing local Postgres.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/auth.ts

@@ -4,7 +4,7 @@ import { organization } from "better-auth/plugins";
 
 import { db } from "./db/index.js";
 import * as authSchema from "./db/schema/auth.js";
-import { env, isProd } from "./env.js";
+import { env } from "./env.js";
 import { ac, roles } from "./lib/access.js";
 import { sendEmail } from "./lib/email.js";
 
@@ -85,7 +85,10 @@ export const auth = betterAuth({
   },
 
   advanced: {
-    useSecureCookies: isProd,
+    // Secure cookies only when actually served over HTTPS — otherwise the
+    // browser silently drops them over http://localhost and login "does
+    // nothing". This is correct regardless of NODE_ENV.
+    useSecureCookies: env.BETTER_AUTH_URL.startsWith("https://"),
     defaultCookieAttributes: { sameSite: "lax" },
     ipAddress: { ipAddressHeaders: ["x-forwarded-for", "x-real-ip"] },
   },

backend/src/env.ts

@@ -23,7 +23,14 @@ const schema = z.object({
   SMTP_FROM: z.string().default("temetro <no-reply@temetro.local>"),
 });
 
-const parsed = schema.safeParse(process.env);
+// docker compose passes unset optionals as empty strings (e.g. `${SMTP_PORT:-}`).
+// Treat empty strings as "unset" so optionals/defaults apply instead of failing
+// coercion (e.g. Number("") === 0).
+const rawEnv = Object.fromEntries(
+  Object.entries(process.env).map(([k, v]) => [k, v === "" ? undefined : v]),
+);
+
+const parsed = schema.safeParse(rawEnv);
 
 if (!parsed.success) {
   const lines = parsed.error.issues