traccar: drive database config from .env instead of a static XML file

The previous fix still baked database.user/database.password directly
into config/traccar.xml, duplicating the secret that .env already held
and leaving a second, unmanaged copy of it on disk.

Traccar supports reading its config from environment variables
(CONFIG_USE_ENVIRONMENT_VARIABLES=true, confirmed against the official
traccar/traccar docker/compose/traccar-mysql.yaml reference). Use that:
DATABASE_DRIVER/URL/USER/PASSWORD are now set in the compose file via
${POSTGRES_*} interpolation from .env, so .env is the only place the
credentials live — drop config/traccar.xml and its volume mount
entirely, matching the official reference example.

Also switched to the official reference healthcheck (wget against
/api/health, 1h start_period) — a real endpoint on real hardware rather
than a guessed /dev/tcp probe against an unverified image's toolset —
and added the interval/start-period env vars to the autoheal container
to match, while keeping the container scoped to just Traccar via the
autoheal=true label instead of the reference's host-wide "all".

Verified with `docker compose config` (both with and without a local
Caddy directory present) that the ${POSTGRES_DB}/${POSTGRES_USER}/
${POSTGRES_PASSWORD} references resolve correctly from .env with no
warnings.

services/traccar.sh

@@ -192,8 +192,9 @@ install_traccar() {
 
     if [ "$DRY_RUN" = true ]; then
         echo "[DRY-RUN] Traccar would:"
-        echo "  - Create $TRACCAR_DIR with docker-compose.yml + config/traccar.xml"
+        echo "  - Create $TRACCAR_DIR with docker-compose.yml + .env"
         echo "  - Deploy a PostgreSQL database container (Traccar no longer ships H2)"
+        echo "  - Point Traccar at it via env vars (CONFIG_USE_ENVIRONMENT_VARIABLES) — no secrets in a config file"
         echo "  - Deploy an autoheal container that restarts Traccar if its healthcheck fails"
         echo "  - Expose port 8082 (web) and 5000-5150 (device protocols)"
         echo "  - Default login: admin@admin.com / admin (change immediately!)"
@@ -263,21 +264,27 @@ ${_CADDY_NET_BLOCK}    healthcheck:
     container_name: traccar
     hostname: traccar
     restart: unless-stopped
+    env_file: .env
     depends_on:
       db:
         condition: service_healthy
     labels:
       - "autoheal=true"
+    environment:
+      CONFIG_USE_ENVIRONMENT_VARIABLES: "true"
+      DATABASE_DRIVER: org.postgresql.Driver
+      DATABASE_URL: jdbc:postgresql://traccar-db:5432/\${POSTGRES_DB}?sslmode=disable
+      DATABASE_USER: \${POSTGRES_USER}
+      DATABASE_PASSWORD: \${POSTGRES_PASSWORD}
     healthcheck:
-      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/127.0.0.1/8082' || exit 1"]
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8082/api/health"]
-      interval: 30s
+      interval: 2m
       timeout: 5s
+      start_period: 1h
       retries: 3
-      start_period: 60s
     volumes:
       - ./logs:/opt/traccar/logs:rw
       - ./data:/opt/traccar/data:rw
-      - ./config/traccar.xml:/opt/traccar/conf/traccar.xml:ro
     ports:
       - "8082:8082"
       - "5000-5150:5000-5150"
@@ -288,7 +295,9 @@ ${_CADDY_NET_BLOCK}
     container_name: traccar-autoheal
     restart: unless-stopped
     environment:
-      - AUTOHEAL_CONTAINER_LABEL=autoheal
+      AUTOHEAL_CONTAINER_LABEL: autoheal
+      AUTOHEAL_INTERVAL: 60
+      AUTOHEAL_START_PERIOD: 3600
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
 ${_CADDY_NET_SECTION}
@@ -299,28 +308,16 @@ TZ=$TZ_VAL
 CADDY_NET=$SITE_CADDY_NET
 
 # PostgreSQL — backs Traccar's database (Traccar's docker image no longer
-# bundles the H2 driver, so a real database is required).
+# bundles the H2 driver, so a real database is required). Traccar reads
+# these directly (CONFIG_USE_ENVIRONMENT_VARIABLES in docker-compose.yml)
+# instead of a config file, so this is the only place the credentials live.
 POSTGRES_DB=traccar
 POSTGRES_USER=traccar
 POSTGRES_PASSWORD=$DB_PASS
 TRACCAR_ENV
     chmod 600 .env
 
-    mkdir -p logs data config db
+    mkdir -p logs data db
-
-    cat > config/traccar.xml << TRACCAR_XML
-<?xml version='1.0' encoding='UTF-8'?>
-
-<!DOCTYPE properties SYSTEM 'http://java.sun.com/dtd/properties.dtd'>
-
-<properties>
-    <entry key='config.default'>./conf/default.xml</entry>
-    <entry key='database.driver'>org.postgresql.Driver</entry>
-    <entry key='database.url'>jdbc:postgresql://traccar-db:5432/traccar?sslmode=disable</entry>
-    <entry key='database.user'>traccar</entry>
-    <entry key='database.password'>$DB_PASS</entry>
-</properties>
-TRACCAR_XML
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$TRACCAR_DIR"
     log_success "Traccar configured at $TRACCAR_DIR"
@@ -336,9 +333,12 @@ Android/iOS app, OwnTracks, or any of 200+ supported device protocols.
 - Web UI: http://localhost:8082
 - Default login: admin@admin.com / admin  (change immediately!)
 - Device protocols: ports 5000-5150 (TCP + UDP)
-- Config: \`config/traccar.xml\`
 - App data: \`data/\` and \`logs/\`
-- Database: PostgreSQL (\`traccar-db\` container, data in \`db/\`, credentials in \`.env\`)
+- Database: PostgreSQL (\`traccar-db\` container, data in \`db/\`)
+- All database settings (name, user, password) live in \`.env\` — Traccar
+  reads them directly via env vars, nothing is duplicated in a config file.
+  Change the password there (then recreate both containers) if you need to
+  rotate it.
 - Autoheal: \`traccar-autoheal\` restarts the \`traccar\` container if its healthcheck fails
 
 ## Manage