Compose: keep the portal enrolment on the data volume

CLOUD_CONFIG_FILE defaulted to a path relative to the working directory, so the
enrolment — this installation's credential and the portal key it pinned — sat
inside the container and was lost on every rebuild, silently detaching a
connected installation. It belongs beside the OAuth key and the flow secrets,
for exactly the same reason.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XtBzdDyLsmDaF1W7DLYtYM

docker/compose.yml

@@ -150,6 +150,10 @@ services:
       # and every issued token with it.
       - MCP_ENABLED=${MCP_ENABLED-false}
       - OAUTH_PRIVATE_KEY_FILE=/data/oauth-key.pem
+      # The portal enrolment, for the same reason: it holds this installation's
+      # credential and the key it pinned, so losing it on a rebuild would mean
+      # enrolling again by hand. Absent until someone connects a portal.
+      - CLOUD_CONFIG_FILE=/data/cloud.json
 
     volumes:
       - app-flow-data:/data