Enhance Docker support and configuration

- Updated .env.example to recommend using docker.env and secrets for sensitive data.
- Modified .gitignore to include docker.env and secrets directory.
- Adjusted docker-compose.yml to utilize environment files and updated port mappings.
- Implemented read_env_or_file utility for better environment variable management.
- Refactored portfolio and trades routers to use the new utility for fetching environment variables.
- Added integration and phase 2 test updates for new environment variable handling.
- Created new documentation for Docker operations and secret management.
- Added placeholder files for Docker secrets and configuration.

.env.docker.tmp

@@ -0,0 +1,45 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# IB Gateway (gnzsnz/ib-gateway:stable)
+# ─────────────────────────────────────────────────────────────────────────────
+TWS_USERID=zemheritrader
+TWS_PASSWORD=3bmp8P$$K4(>89oZ}xQ
+TRADING_MODE=paper                    # paper | live
+VNC_SERVER_PASSWORD=GucluVNC123
+TWOFA_TIMEOUT_ACTION=exit          # restart | exit
+AUTO_RESTART_TIME=11:59 PM
+RELOGIN_AFTER_2FA_TIMEOUT=no
+TIME_ZONE=Europe/Istanbul             # e.g. America/New_York, Europe/London
+
+# ─────────────────────────────────────────────────────────────────────────────
+# FastAPI Application
+# ─────────────────────────────────────────────────────────────────────────────
+IBKR_HOST=ib-gateway                  # Docker service name; use 127.0.0.1 for local
+IBKR_PORT=4002                        # paper=4002, live=4001
+IBKR_CLIENT_ID=1
+WEBHOOK_SECRET=change_this_to_a_strong_random_secret   # openssl rand -hex 32
+DB_PATH=/app/trades.db
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Risk Management
+# ─────────────────────────────────────────────────────────────────────────────
+MAX_DAILY_LOSS=500.0
+MAX_POSITIONS=5
+MAX_ORDER_VALUE=10000.0
+
+# ─────────────────────────────────────────────────────────────────────────────
+# UI Authentication (HTTP Basic Auth — opt-in)
+# Leave both unset to disable auth (trusted network / Tailscale only)
+# Set both to enable auth on all UI pages (/, /scanner, /tradelog, /portfolio)
+# /health and /webhook are always public regardless of this setting
+# ─────────────────────────────────────────────────────────────────────────────
+# UI_USERNAME=admin
+# UI_PASSWORD=change_this_strong_password
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Traefik (external reverse proxy — must be running as a separate stack)
+# ─────────────────────────────────────────────────────────────────────────────
+TRAEFIK_NETWORK=traefik-public        # External Docker network Traefik is attached to
+TRAEFIK_HOST=ibkr.your-tailnet.ts.net # Hostname Traefik routes on (your Tailscale FQDN)
+TRAEFIK_ENTRYPOINT=websecure          # Traefik entrypoint name (websecure=HTTPS, web=HTTP)
+RELOGIN_AFTER_TWOFA_TIMEOUT=no
+EXISTING_SESSION_DETECTED_ACTION=primaryoverride