build(intake): give the container an ANTHROPIC_API_KEY (#223)

The drafting worker needs a credential, and a Portainer stack variable alone does not reach the container — stack variables are interpolated into the compose file as ${VAR}, and a service receives exactly what its own environment block lists. That is how UPLOADS_DIR went missing in #118, and both files say so; this adds the line that makes the variable actually arrive.

QA takes it from QA_ANTHROPIC_API_KEY, prefixed like the database and SMTP credentials so production's key cannot be pasted there and silently work. It is also worth a key of its own rather than sharing production's, because this is the only credential in either stack that spends money per call, on a path anybody holding an upload link can trigger.

Absent is a working configuration in both, deliberately, which is why prod's line carries `:-` and neither variable joins the always-required list. A submission still arrives, keeps its photos and waits undrafted. Losing somebody's consignment to an expired key would be far worse than an item arriving without its description written, and the photos may be the only copy of something no longer in the sender's hands. USPS is the existing precedent for a credential whose absence degrades rather than fails.

The comments say plainly that a spend limit belongs on the key in the Anthropic console, since nothing in this repository can enforce one and #227's submission ceiling bounds the volume rather than the bill.

docs/ops/production-stack-cutover.md said the compose file interpolates thirteen names and listed them. It now says fourteen, because that document stakes its usefulness on being checked against the file rather than written from memory — a cutover working from a stale list is how a variable gets left behind, which is the failure the document exists to prevent. Counted from the file: exactly fourteen.

composeEnvironment.test.ts passes, 24 tests. It checks that every deployment sets what the validator requires, so adding a variable ahead of a validator entry cannot break it — the entry itself comes with the worker.

Ref #223

docker-compose.prod.yml

@@ -90,6 +90,14 @@
 #   USPS_CLIENT_ID        Optional. Leave unset to run without address
 #   USPS_CLIENT_SECRET    validation; the app degrades gracefully rather than
 #                         failing, so an empty value is a working configuration.
+#   ANTHROPIC_API_KEY     Optional. Drafts a listing from a submitted photo
+#                         (#223). Unset means submissions still arrive and wait
+#                         undrafted, which is a working configuration for the
+#                         same reason USPS is. The one credential here that
+#                         spends money per call, and on a path anybody holding
+#                         an upload link can trigger — put a spend limit on the
+#                         key in the Anthropic console, because nothing in this
+#                         repository can enforce one.
 #
 # The names above are what this file reads. A stack variable under any other
 # name is substituted nowhere and never reaches the container, so reconciling
@@ -202,6 +210,21 @@ services:
       # this same container, and a certificate that covers it. Until then the
       # server warns at boot that the defence is off rather than staying silent.
       - UPLOADS_BASE_URL=${UPLOADS_BASE_URL:-}
+
+      # Drafts a listing from a submitted photo (#223).
+      #
+      # Absent is a working configuration, deliberately. A submission still
+      # arrives, keeps its photos and waits in the queue undrafted — losing
+      # somebody's consignment to an expired key would be far worse than an
+      # item arriving without its description written, and the photos may be
+      # the only copy of an item no longer in the sender's hands.
+      #
+      # The one credential in this stack that spends money per call, on a path
+      # anybody holding an upload link can trigger. Set a spend limit on the
+      # key in the Anthropic console — nothing in this repository can enforce
+      # one, and #227 is the submission ceiling that bounds the volume rather
+      # than the bill.
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
     volumes:
       # Production's own uploads directory. QA writes to
       # /volume1/configs/redefined-designs-qa/uploads; sharing this one would