refactor!: move every config default into compose.yml

compose.yml now holds each default as ${VAR:-default}, and the code keeps
no fallback values. The bot stops at startup on a missing or invalid
PORT or LOG_LEVEL, /addsticker refuses without STICKER_PACK_NAME, and the
renderer refuses to start until every RENDERER_* setting is a valid
value, listing each problem. Settings whose empty value means none or
all (MODULES, OWNER_ID, ADMIN_IDS, the API tokens) use ${VAR:-}.

The renderer's npm start and dev load .env when present, so a local run
works from a copy of .env.example.

BREAKING CHANGE: running outside compose now requires LOG_LEVEL and PORT
for the bot, STICKER_PACK_NAME for /addsticker, and every RENDERER_*
variable for the renderer.

.env.example

@@ -25,7 +25,8 @@ ADMIN_IDS=
 # MUST end in _by_<this bot username>: Telegram requires that suffix on sets a
 # bot creates and refuses to edit sets it did not create, so the suffix is what
 # proves the pack is manageable. Created automatically, owned by OWNER_ID, on
-# the first /addsticker if it does not exist yet. Unset = the default below.
+# the first /addsticker if it does not exist yet. Required by /addsticker:
+# the code has no fallback (compose.yml supplies this value as its default).
 STICKER_PACK_NAME=miti99_by_miti99bot
 
 # SOURCE_COMMIT (commit SHA) is read at startup for the deploynotify owner DM.
@@ -44,10 +45,16 @@ LOL_PANDASCORE_TOKEN=
 # only when running the bot outside compose. Leave blank to fall back to text.
 RENDERER_URL=
 
+# ============================ Runtime =============================
+# Required: the code has no fallback. compose.yml supplies these values as its
+# defaults; set them yourself when running outside compose.
+# Log level: debug, info, warn, or error.
+LOG_LEVEL=info
+# Internal health server port.
+PORT=8080
+
 # ====================== Leave UNSET on self-host ==================
-# Defaults are correct for self-host:
 #   KV_PROVIDER          — auto-selects mongodb because MONGO_URL is set
-#   PORT                 — defaults to 8080 (internal health server)
 #   TELEGRAM_WEBHOOK_SECRET — long polling has no webhook
 #   GOLD_VNAPP_API_KEY   — gold module auto-fetches + caches the key to Mongo
 # Stock/coin/gold URL env overrides are not supported; modules use coded