feat: add required environment variable checks for stack deployment

.gitea/workflows/deploy.yml

@@ -77,6 +77,27 @@ jobs:
           echo "Loaded $(printf '%s' "${ENV_JSON}" | jq 'length') env entries from ENV_VARS"
           echo "ENV names preview:"
           printf '%s' "${ENV_JSON}" | jq -r '.[0:10][]?.name' || true
+
+          REQUIRED_ENV_KEYS=(
+            APP_PASSWORD
+            JWT_SECRET
+            SPRING_DATASOURCE_USERNAME
+            SPRING_DATASOURCE_PASSWORD
+            APP_RECIPIENTS
+          )
+
+          MISSING_KEYS=()
+          for REQUIRED_KEY in "${REQUIRED_ENV_KEYS[@]}"; do
+            if ! printf '%s' "${ENV_JSON}" | jq -e --arg required_key "${REQUIRED_KEY}" 'map(.name) | index($required_key) != null' >/dev/null; then
+              MISSING_KEYS+=("${REQUIRED_KEY}")
+            fi
+          done
+
+          if [ "${#MISSING_KEYS[@]}" -gt 0 ]; then
+            echo "ENV_VARS is missing required keys: ${MISSING_KEYS[*]}"
+            exit 1
+          fi
+
           echo "Portainer base URL: ${PORTAINER_BASE_URL}"
           echo "Target stack: ${STACK_NAME}"
           echo "Endpoint id set: $([ -n "${PORTAINER_ENDPOINT_ID}" ] && echo yes || echo no)"

docker-compose.prod.yml

@@ -34,6 +34,7 @@ services:
       SPRING_DATASOURCE_URL: jdbc:postgresql://condado-newsletter-postgres:5432/${APP_DB_NAME:-condado}
       SPRING_DATASOURCE_USERNAME: ${SPRING_DATASOURCE_USERNAME:-condado}
       SPRING_DATASOURCE_PASSWORD: ${SPRING_DATASOURCE_PASSWORD:-condado}
+      APP_PASSWORD: ${APP_PASSWORD}
       JWT_SECRET: ${JWT_SECRET}
       JWT_EXPIRATION_MS: ${JWT_EXPIRATION_MS:-86400000}
       MAIL_HOST: ${MAIL_HOST}