fix(demo): fix Reactive Resume AUTH_SECRET, Kiwix ZIM download, Apple Health check

- Add AUTH_SECRET env var required by Reactive Resume
- Kiwix auto-downloads Wikipedia Medical ZIM on first start
- Simplify Apple Health healthcheck to use InfluxDB ready() API
- Add all missing service config vars to ensure_env bootstrapping

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

demo/docker-compose.yml.template

@@ -701,6 +701,7 @@ services:
       STORAGE_SECRET_KEY: ${RESUME_MINIO_PASSWORD}
       STORAGE_USE_SSL: "false"
       STORAGE_SKIP_BUCKET_CHECK: "false"
+      AUTH_SECRET: ${RESUME_ACCESS_TOKEN_SECRET}
     labels:
       homepage.group: "Productivity"
       homepage.name: "Reactive Resume"
@@ -762,6 +763,14 @@ services:
       - "${KIWIX_PORT}:8080"
     volumes:
       - ${COMPOSE_PROJECT_NAME}_kiwix_data:/data
+    command: >
+      sh -c "
+        if [ -z \"$$(ls -A /data/*.zim 2>/dev/null)\" ]; then
+          echo 'No ZIM files found. Downloading Wikipedia Medical Encyclopedia...';
+          wget -q -O /data/wikipedia_en_medicine_maxi.zim 'https://download.kiwix.org/zim/wikipedia/wikipedia_en_medicine_maxi.zim' || echo 'Download failed - Kiwix will serve empty';
+        fi
+        kiwix-serve /data/*.zim
+      "
     environment:
       - PUID=${DEMO_UID}
       - PGID=${DEMO_GID}