chore(dev): auto-load env and hide compose secrets

dev/docker-compose.yml

@@ -20,11 +20,20 @@ services:
     container_name: zeroclaw-dev
     restart: unless-stopped
     environment:
-      - API_KEY
-      - PROVIDER
-      - ZEROCLAW_MODEL
       - ZEROCLAW_GATEWAY_PORT=3000
       - SANDBOX_HOST=zeroclaw-sandbox
+    secrets:
+      - source: zeroclaw_env
+        target: zeroclaw_env
+    entrypoint: ["/bin/bash", "-lc"]
+    command:
+      - |
+        if [ -f /run/secrets/zeroclaw_env ]; then
+          set -a
+          . /run/secrets/zeroclaw_env
+          set +a
+        fi
+        exec zeroclaw gateway --port "${ZEROCLAW_GATEWAY_PORT:-3000}" --host "[::]"
     volumes:
       # Mount single config file (avoids shadowing other files in .zeroclaw)
       - ../target/.zeroclaw/config.toml:/zeroclaw-data/.zeroclaw/config.toml
@@ -57,3 +66,7 @@ services:
 networks:
   dev-net:
     driver: bridge
+
+secrets:
+  zeroclaw_env:
+    file: ../.env