Fix functional bugs found in service audit

wg-easy: PASSWORD env var removed in v14+; generate bcrypt hash at install
  time via 'docker run wg-easy wgpw' and write PASSWORD_HASH instead.

ntfy: write config/server.yml with base-url, cache-file, auth-file, and
  behind-proxy:true so push notification links work when behind Caddy.
  auth-default-access: deny-all (require topic auth).

mealie: BASE_URL was hardcoded to http://localhost:9925; email links and
  OAuth redirects broke when served via Caddy. Now computed from SITE_DOMAIN
  and written to .env so it's easy to update.

nextcloud: add OVERWRITEPROTOCOL=https, OVERWRITECLIURL, TRUSTED_PROXIES to
  .env so share links and internal redirects use https:// behind Caddy.

onlyoffice: Caddy's default X-Frame-Options: SAMEORIGIN header blocked
  OnlyOffice from being embedded as an iframe in Nextcloud. Override it in
  the Caddy site block to allow framing.

vaultwarden: remove exposed port 3012 (WebSocket — not needed since v1.29+,
  all handled on port 80). Publish port 8888 for direct host access instead.
  Remove WEBSOCKET_ENABLED=true (ignored in current versions).

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

services/mealie.sh

@@ -169,6 +169,13 @@ install_mealie() {
     TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
     UID_VAL=$(id -u "$ACTUAL_USER"); GID_VAL=$(id -g "$ACTUAL_USER")
 
+    # BASE_URL must match the public URL Mealie is served on (used for email links,
+    # OAuth redirects, and the web app manifest). Default to SITE_DOMAIN if set.
+    local MEALIE_BASE_URL="http://localhost:9925"
+    if [ -n "$SITE_DOMAIN" ] && [ "$SITE_DOMAIN" != "example.com" ]; then
+        MEALIE_BASE_URL="https://recipes.${SITE_DOMAIN}"
+    fi
+
     cat > docker-compose.yml << MEALIE_COMPOSE
 name: mealie
 
@@ -178,6 +185,7 @@ services:
     container_name: mealie
     hostname: mealie
     restart: unless-stopped
+    env_file: .env
     environment:
       - PUID=$UID_VAL
       - PGID=$GID_VAL
@@ -185,7 +193,6 @@ services:
       - ALLOW_SIGNUP=true
       - MAX_WORKERS=1
       - WEB_CONCURRENCY=1
-      - BASE_URL=http://localhost:9925
     volumes:
       - ./data:/app/data
     ports:
@@ -199,6 +206,13 @@ networks:
     name: \${CADDY_NET:-caddy_net}
 MEALIE_COMPOSE
 
+    cat > .env << MEALIE_ENV
+# Public URL Mealie is served on — used for email links and OAuth redirects.
+# Update if you change your domain or switch from HTTP to HTTPS.
+BASE_URL=$MEALIE_BASE_URL
+CADDY_NET=$SITE_CADDY_NET
+MEALIE_ENV
+
     mkdir -p data
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$MEALIE_DIR"
     log_success "Mealie configured at $MEALIE_DIR"