docker-compose: mount Box secret at /run/secrets/box-config.json

Short-form `- box-config` mounted the file at /run/secrets/box-config
(no extension), but BOX_CONFIG_FILE everywhere references the .json
suffix. Switch to long-form `target:` so the mount path matches the
configured env value and isBoxConfigured() reads the right file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -81,7 +81,12 @@ services:
     volumes:
       - uploads_data:/data/uploads
     secrets:
-      - box-config
+      # Long-form so the secret lands at `/run/secrets/box-config.json` —
+      # matching BOX_CONFIG_FILE above. The default short-form would mount
+      # at `/run/secrets/box-config` (no extension), causing isBoxConfigured()
+      # to read from the wrong path.
+      - source: box-config
+        target: box-config.json
     depends_on:
       db:
         condition: service_healthy