fix(security): Remove insecure session secret fallback in compose.debug.yml

TASK-027: The compose.debug.yml file had a publicly known weak session secret as
a fallback value. This has been replaced with an explicit requirement via the :?
bash parameter expansion pattern, forcing developers to set BANGUI_SESSION_SECRET.

Changes:
- Changed BANGUI_SESSION_SECRET fallback to use :? pattern with clear error message
- Created .env.example with placeholder values and generation instructions
- Added first-run setup instructions to Instructions.md
- Verified .env is already in .gitignore

The error message provides clear guidance:
'BANGUI_SESSION_SECRET must be set — generate with: python -c "import secrets; print(secrets.token_hex(32))"'

Severity: Medium
- Prevents exposure of session secret in repositories
- Ensures each environment has unique secrets
- Aligns with production compose.prod.yml which already uses this pattern

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Docs/Instructions.md

@@ -179,7 +179,37 @@ Verify against [Architekture.md](Architekture.md) and the project structure rule
 
 ---
 
-## 7. Dev Quick-Reference
+## 7. First-Run Setup
+
+### Initialize the Development Environment
+
+Before starting the stack for the first time, set up the required environment variables:
+
+1. **Copy the example environment file:**
+   ```bash
+   cp .env.example .env
+   ```
+
+2. **Generate a session secret:**
+   ```bash
+   python -c 'import secrets; print(secrets.token_hex(32))'
+   ```
+   Copy the output and paste it as the value for `BANGUI_SESSION_SECRET` in your `.env` file.
+
+3. **Optional: Customize other settings**
+   - Edit `.env` to adjust timezone, port numbers, or other settings
+   - Default values are sensible for development (UTC, ports 8000/5173)
+
+4. **Start the stack:**
+   ```bash
+   make up
+   ```
+
+**Note:** The session secret is critical for security. Do not commit `.env` to version control — it is already in `.gitignore`. Each environment (dev, staging, production) must have its own unique secret.
+
+---
+
+## 8. Dev Quick-Reference
 
 ### Start / stop the stack