fix(security): Remove insecure session secret fallback in compose.debug.yml

TASK-027: The compose.debug.yml file had a publicly known weak session secret as
a fallback value. This has been replaced with an explicit requirement via the :?
bash parameter expansion pattern, forcing developers to set BANGUI_SESSION_SECRET.

Changes:
- Changed BANGUI_SESSION_SECRET fallback to use :? pattern with clear error message
- Created .env.example with placeholder values and generation instructions
- Added first-run setup instructions to Instructions.md
- Verified .env is already in .gitignore

The error message provides clear guidance:
'BANGUI_SESSION_SECRET must be set — generate with: python -c "import secrets; print(secrets.token_hex(32))"'

Severity: Medium
- Prevents exposure of session secret in repositories
- Ensures each environment has unique secrets
- Aligns with production compose.prod.yml which already uses this pattern

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.env.example

@@ -0,0 +1,28 @@
+# ──────────────────────────────────────────────────────────────
+#  BanGUI — Environment Variables Template
+#  Copy this file to .env and fill in the values below
+# ──────────────────────────────────────────────────────────────
+
+# Session Secret (REQUIRED)
+# Generate a secure random secret for session tokens.
+# WARNING: Do not use the same secret across different environments.
+# Generate with: python -c 'import secrets; print(secrets.token_hex(32))'
+# Example value: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
+BANGUI_SESSION_SECRET=
+
+# Timezone (optional, defaults to UTC)
+# Use standard timezone names from the IANA Time Zone Database
+# Examples: America/New_York, Europe/London, Asia/Tokyo, UTC
+BANGUI_TIMEZONE=UTC
+
+# Backend port (optional, defaults to 8000)
+# When using docker-compose, this is the port on your host machine
+BANGUI_BACKEND_PORT=8000
+
+# Frontend port (optional, defaults to 5173)
+# When using docker-compose, this is the port on your host machine
+BANGUI_FRONTEND_PORT=5173
+
+# Public port (optional, defaults to 8080)
+# When using production compose, this is the public-facing port
+BANGUI_PORT=8080