fix: pass POLAR_API_TOKEN and POLAR_WEBHOOK_SECRET to ui container

Both vars were present in Doppler but never injected into the ui service
environment, causing all checkout requests to fail with 500 and webhooks
to be silently rejected.

docker-compose.yml

@@ -310,6 +310,9 @@ services:
       GOOGLE_CLIENT_SECRET: "${GOOGLE_CLIENT_SECRET}"
       GITHUB_CLIENT_ID: "${GITHUB_CLIENT_ID}"
       GITHUB_CLIENT_SECRET: "${GITHUB_CLIENT_SECRET}"
+      # Polar (subscriptions)
+      POLAR_API_TOKEN: "${POLAR_API_TOKEN}"
+      POLAR_WEBHOOK_SECRET: "${POLAR_WEBHOOK_SECRET}"
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/health"]
       interval: 15s