Wire cosign/SLSA, ticket-webhook, and API rate-limit env vars into compose

[haksungjang]

Summary

• 7 vars documented in .env.example, across three small clusters, were never referenced in x-backend-env, so setting them in .env had no effect on the running container:
  • cosign public-key path override + SLSA provenance builder ID
  • the generic ticket-webhook events/token/URL
  • two API rate limits (read endpoints, CSV export)
• Adds them to both compose files with defaults matching core/config.py exactly.

Why bundled

Each cluster is only 2-3 vars — too small to justify its own PR on top of the eight already in this batch. Kept as one PR with each cluster separately commented.

Context

This is the last PR in the compose env-var wiring audit that started with #300. Full batch: #300, #301, #303, #304, #306, #307, #308, #309, #310, #311, and this one.

Test plan

• Both compose files parse as valid YAML
• Reviewer: this touches the same anchor lines as other PRs in the batch — rebase on merge if needed