APP_ENV removal and secure cookie handling (#333)

Hey, made the tweaks we discussed, plus a couple related fixes :)

- Removed APP_ENV entirely. All dev-specific functionality is enabled
via `DEBUG: true` env var
- Set secure cookie handling to false by default, added to the readme to
enable if exclusively using HTTPS connection
- Fixed healthcheck potentially not working with auth enabled
- Removed APP_ENV from docker compose files and made sure app.db lines
are included in all versions.

APP_ENV in people's existing composes should get ignored entirely and
will be put on the default env, so no issues when updating.

docker-compose.extbp.dev.yml

@@ -10,7 +10,6 @@ services:
       target: cwa-bd-extbp
     environment:
       DEBUG: true
-      APP_ENV: dev
       USE_DOH: true
       CUSTOM_DNS: cloudflare
       USE_CF_BYPASS: true  # Enable Cloudflare bypass (default: true)