Enhance Docker support and configuration

- Updated .env.example to recommend using docker.env and secrets for sensitive data.
- Modified .gitignore to include docker.env and secrets directory.
- Adjusted docker-compose.yml to utilize environment files and updated port mappings.
- Implemented read_env_or_file utility for better environment variable management.
- Refactored portfolio and trades routers to use the new utility for fetching environment variables.
- Added integration and phase 2 test updates for new environment variable handling.
- Created new documentation for Docker operations and secret management.
- Added placeholder files for Docker secrets and configuration.

docker-compose.yml

@@ -3,21 +3,23 @@ services:
   ib-gateway:
     image: ghcr.io/gnzsnz/ib-gateway:stable
     restart: always
+    env_file:
+      - ${COMPOSE_APP_ENV_FILE:-docker.env}
     environment:
-      - TWS_USERID=${TWS_USERID}
-      - TWS_PASSWORD=${TWS_PASSWORD}
       - TRADING_MODE=${TRADING_MODE:-paper}
-      - VNC_SERVER_PASSWORD=${VNC_SERVER_PASSWORD}
       - TWOFA_TIMEOUT_ACTION=${TWOFA_TIMEOUT_ACTION:-restart}
       - AUTO_RESTART_TIME=${AUTO_RESTART_TIME:-11:59 PM}
-      - RELOGIN_AFTER_2FA_TIMEOUT=${RELOGIN_AFTER_2FA_TIMEOUT:-yes}
+      - RELOGIN_AFTER_TWOFA_TIMEOUT=${RELOGIN_AFTER_TWOFA_TIMEOUT:-yes}
+      - EXISTING_SESSION_DETECTED_ACTION=${EXISTING_SESSION_DETECTED_ACTION:-primaryoverride}
       - TIME_ZONE=${TIME_ZONE:-America/New_York}
     ports:
-      - "127.0.0.1:4001:4001"
-      - "127.0.0.1:4002:4002"
+      - "127.0.0.1:4001:4003"
+      - "127.0.0.1:4002:4004"
       - "127.0.0.1:5900:5900"
+    volumes:
+      - ./secrets:/run/secrets:ro
     healthcheck:
-      test: ["CMD-SHELL", "nc -z localhost 4002 || exit 1"]
+      test: ["CMD-SHELL", "bash -lc ': >/dev/tcp/127.0.0.1/4004' || bash -lc ': >/dev/tcp/127.0.0.1/4003' || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 5
@@ -28,15 +30,18 @@ services:
   ibkr-dashboard:
     build: .
     restart: unless-stopped
-    env_file: .env
+    env_file:
+      - ${COMPOSE_APP_ENV_FILE:-docker.env}
     environment:
       - IBKR_HOST=ib-gateway
-      - IBKR_PORT=4002
+      - IBKR_PORT=4004
+      - DB_PATH=/app/data/trades.db
     # Port exposed only for local testing — can be removed when accessed exclusively via Traefik
     ports:
       - "127.0.0.1:8000:8000"
     volumes:
-      - ./trades.db:/app/trades.db
+      - ./data:/app/data
+      - ./secrets:/run/secrets:ro
     depends_on:
       ib-gateway:
         condition: service_healthy