style: order environment variables by how much the service needs them

environment: blocks were in no particular order. They now run must-have ->
should-have -> optional, with related variables kept adjacent as a group that
takes the tier of its most important member: PUID/PGID, PASSWORD with
SUDO_PASSWORD, DOCKER_MODS ahead of the INSTALL_PACKAGES and
NODEJS_MOD_VERSION that configure it, the four GIT_* entries, the PASEO_*
daemon settings.

Each .env.example is reordered to match its compose file. The names do not map
one to one -- PASSWORD feeds both PASSWORD and SUDO_PASSWORD, SERVICE_HOSTNAME
feeds HOST -- so an entry sits where the first compose entry reading it sits.

The HOST comment in both compose files is dropped; the READMEs already carry
that explanation in full. CLAUDE.md records the ordering convention.

alloy and gitea-mirror-local are untouched: every variable there is required,
so the tiers collapse and the existing grouping is the better one.

code-server/.env.example

@@ -2,10 +2,6 @@
 #
 #   cp .env.example .env
 
-# Container hostname, also passed in as HOST -- the name zsh's prompt shows.
-# Not named HOSTNAME: the deploying shell's own HOSTNAME would override it.
-SERVICE_HOSTNAME=code-server
-
 # Web UI login password. MUST NOT be blank -- the LinuxServer image serves
 # code-server without authentication when PASSWORD is empty.
 # Also used for SUDO_PASSWORD inside the container.
@@ -15,3 +11,7 @@ PASSWORD=
 # Git identity baked into the container (author + committer).
 GIT_NAME=
 GIT_EMAIL=
+
+# Container hostname, also passed in as HOST -- the name zsh's prompt shows.
+# Not named HOSTNAME: the deploying shell's own HOSTNAME would override it.
+SERVICE_HOSTNAME=code-server