Pass SHOTS_API_KEY through to the app container

The import-shots feature calls review.twotalesvfx.com from a server
action that reads process.env.SHOTS_API_KEY. That variable existed only
in the local gitignored .env, and the compose file passed just
DATABASE_URL, NEXTAUTH_SECRET and NEXTAUTH_URL to the app service. In
production the key was therefore undefined, so the action threw before
issuing any request -- and because Next.js masks server-action errors in
production, the UI showed a generic failure that looked like a network
or CDN problem rather than missing configuration.

Interpolate SHOTS_API_KEY from the deploy environment instead of
hardcoding it, so the secret stays out of the repo. The :? guard makes
compose abort with an explanatory message when the variable is missing,
rather than silently starting an app that cannot import shots.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -32,6 +32,7 @@ services:
       DATABASE_URL: postgresql://postgres:postgres@postgres:5432/xbid
       NEXTAUTH_SECRET: hZTKvtZtchjbJulsVE8Kf5YPLibR619JoK/z7vO2i/s=
       NEXTAUTH_URL: https://xbid.twotalesvfx.com
+      SHOTS_API_KEY: ${SHOTS_API_KEY:?SHOTS_API_KEY must be set in the .env file next to docker-compose.yml}
 
     depends_on:
       postgres: