Fix three crash-looping services: koha-db, homebox, vaultwarden

koha-db: compose used MYSQL_ROOT_PASSWORD/MYSQL_DATABASE/MYSQL_USER/
MYSQL_PASSWORD, but this mariadb:11 image version's entrypoint doesn't
recognize MYSQL_ROOT_PASSWORD as any of its accepted root-password
options at all. Confirmed live: "Database is uninitialized and password
option is not specified" on every start, even though DB_ROOT_PASS was
correctly generated and present in .env the whole time. Switched all
four to their MARIADB_* equivalents.

homebox: a newer homebox release requires HBOX_AUTH_API_KEY_PEPPER (at
least 32 bytes) or the container panics on startup — this installer
never set it. Generate one with generate_password 48 and wire it
through .env + the compose environment block.

vaultwarden: the SMTP setup prompts let you enter a host but leave
"SMTP from address" blank (no default), writing a half-configured state
Vaultwarden refuses to start with ("Both SMTP_HOST and SMTP_FROM need
to be set"). Validate after prompting — if SMTP_HOST is set but
SMTP_FROM came back empty, disable SMTP entirely instead of writing a
config known to crash the container.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/homebox.sh

@@ -301,6 +301,16 @@ networks:
 "
     fi
 
+    # Required since a newer homebox release, not optional — confirmed
+    # live: without it the container panics on every start ("auth.
+    # api_key_pepper must be set to at least 32 bytes") and crash-loops.
+    # generate_password's default alphanumeric output is 1 byte/char, so
+    # 48 chars comfortably clears the 32-byte minimum. Rotating this later
+    # invalidates every issued API key, per homebox's own panic message —
+    # generated once here, never touched again on a rerun.
+    local HB_PEPPER
+    HB_PEPPER="$(generate_password 48)"
+
     cat > docker-compose.yml << HB_COMPOSE
 name: $CONTAINER
 
@@ -313,6 +323,7 @@ services:
     environment:
       - HBOX_LOG_LEVEL=info
       - HBOX_WEB_MAX_UPLOAD_SIZE=10
+      - HBOX_AUTH_API_KEY_PEPPER=\${HBOX_AUTH_API_KEY_PEPPER}
     volumes:
       - ./data:/data
     ports:
@@ -322,7 +333,11 @@ HB_COMPOSE
 
     cat > .env << HB_ENV
 CADDY_NET=$SITE_CADDY_NET
+
+# Rotating this invalidates every issued API key.
+HBOX_AUTH_API_KEY_PEPPER=$HB_PEPPER
 HB_ENV
+    chmod 600 .env
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$HB_DIR"