fix(mappa): add MAPPA_API_TOKEN to prod stack env (#1033)

Shared-token auth was off on prod (no MAPPA_API_TOKEN) — anyone with network
access could call /admin/purge_secrets and all mutations. Token generated,
stored in pass mappa/full-env, wired into stack env + agent MCP configs
(~/.claude.json). Redeployed via Portainer (stack 27). Verify: /inbox without
token → 401, with token → 200.

host-stacks/vds-kzntsv/mappa.compose.yml

@@ -15,6 +15,7 @@ services:
     environment:
       DATABASE_URL: postgres://mappa:${MAPPA_DB_PASS}@postgres:5432/mappa
       MAPPA_GITEA_TOKEN: ${MAPPA_GITEA_TOKEN}
+      MAPPA_API_TOKEN: ${MAPPA_API_TOKEN}
     healthcheck:
       test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8731/health"]
       interval: 15s