style: order environment variables by how much the service needs them

environment: blocks were in no particular order. They now run must-have ->
should-have -> optional, with related variables kept adjacent as a group that
takes the tier of its most important member: PUID/PGID, PASSWORD with
SUDO_PASSWORD, DOCKER_MODS ahead of the INSTALL_PACKAGES and
NODEJS_MOD_VERSION that configure it, the four GIT_* entries, the PASEO_*
daemon settings.

Each .env.example is reordered to match its compose file. The names do not map
one to one -- PASSWORD feeds both PASSWORD and SUDO_PASSWORD, SERVICE_HOSTNAME
feeds HOST -- so an entry sits where the first compose entry reading it sits.

The HOST comment in both compose files is dropped; the READMEs already carry
that explanation in full. CLAUDE.md records the ordering convention.

alloy and gitea-mirror-local are untouched: every variable there is required,
so the tiers collapse and the existing grouping is the better one.

paseo/.env.example

@@ -17,11 +17,9 @@ PASEO_HOSTNAMES=
 # `uniquelocal` covers the private ranges Docker bridge networks use.
 PASEO_TRUSTED_PROXIES=uniquelocal
 
-# Container hostname, shown as the host label in the web UI. Without it the
-# label is a random container ID. Also passed in as HOST -- the name zsh's
-# prompt shows. Not named HOSTNAME: the deploying shell's own HOSTNAME would
-# override it.
-SERVICE_HOSTNAME=paseo
+# Shell for Paseo's terminals. Paseo reads $SHELL and otherwise falls back to
+# /bin/sh (dash); it ignores the user's login shell, so `chsh` has no effect.
+SHELL=/bin/zsh
 
 # Agent CLIs to install on start, if not already present. Space- or
 # comma-separated, from: claude codex opencode copilot omp pi. Leave empty to
@@ -37,6 +35,8 @@ TZ=Asia/Ho_Chi_Minh
 GIT_NAME=
 GIT_EMAIL=
 
-# Shell for Paseo's terminals. Paseo reads $SHELL and otherwise falls back to
-# /bin/sh (dash); it ignores the user's login shell, so `chsh` has no effect.
-SHELL=/bin/zsh
+# Container hostname, shown as the host label in the web UI. Without it the
+# label is a random container ID. Also passed in as HOST -- the name zsh's
+# prompt shows. Not named HOSTNAME: the deploying shell's own HOSTNAME would
+# override it.
+SERVICE_HOSTNAME=paseo