fix(self-hosting): pass AI provider keys through to the web container

[DPS0340]

Same wiring-gap class as #2035 / #1993, found by sweeping every var in the env schema against both compose files.

Problem

self-hosting.mdx tells self-hosters to set these:

DEEPGRAM_API_KEY=your-key    # Transcription
GROQ_API_KEY=your-key        # AI summaries (preferred)
OPENAI_API_KEY=your-key      # AI summaries (fallback)

and docker-compose.coolify.env.example lists all three (lines 64, 67, 68). But neither compose file passes any of them into cap-web, so the operator sets them and nothing happens.

The failure is silent, which is what makes it worth fixing rather than just documenting. Both features check the key and return early:

// apps/web/lib/transcribe.ts:32
if (!serverEnv().DEEPGRAM_API_KEY) {
  return { success: false, message: "Missing necessary environment variables" };
}

// apps/web/lib/generate-ai.ts:32
if (!serverEnv().GROQ_API_KEY && !serverEnv().OPENAI_API_KEY) {

So on a self-hosted instance transcription and AI summaries just never produce output, with no configuration error surfaced to the user — they followed the docs and the feature is simply absent.

Fix

Map the three vars in both compose files, matching how the other optional integrations (RESEND_API_KEY, GOOGLE_CLIENT_ID, APPLE_CLIENT_SECRET) are already wired.

Defaulting to empty via :- means behaviour is unchanged for anyone not using these: the vars stay unset, the schema treats them as optional(), and the existing early-returns keep the features off.

How I found it

Extracted every uppercase identifier from packages/env/server.ts and diffed against both compose files. Most of the unmapped ones are legitimately cloud-only (VERCEL_*, STRIPE_*, WORKOS_*, CLOUDFRONT_*, TINYBIRD_*) and shouldn't be in a self-host template. These three are different: the self-hosting docs explicitly instruct users to set them, which makes the omission a bug rather than a scoping decision.

CAP_CHROME_EXTENSION_ID was the fourth in that category and is handled in #2035.

Verification

Both files parse as valid YAML and all three keys resolve:

docker-compose.yml
   DEEPGRAM_API_KEY: '${DEEPGRAM_API_KEY:-}'
   GROQ_API_KEY: '${GROQ_API_KEY:-}'
   OPENAI_API_KEY: '${OPENAI_API_KEY:-}'
docker-compose.coolify.yml
   ...same

No application code touched.

Diff: 2 files, +6/-0. Independent of #2035 — either can merge first.

[DPS0340]

@tembo please review

[DPS0340]

Same CI note as #2035: Test Self-Hosting and CI are in action_required pending maintainer approval of workflow runs for a first-time contributor.

Worth approving here specifically — test-self-hosting.yml triggers on docker-compose.yml / docker-compose.coolify.yml, which is exactly what this changes, and it stands the full stack up rather than just linting the file.

Locally verified both files parse and all three keys resolve to '${VAR:-}'. The red Vercel is the standard fork deploy-token failure.