fix: bake SCANNER_SERVICE_URL into the combined image

Bake SCANNER_SERVICE_URL=http://127.0.0.1:8001 and PYTHONUNBUFFERED=1
into /etc/profile.d/consentos.sh inside the image and source that file
from /entrypoint.sh so every supervisord child (api, worker, beat,
scanner) inherits the same defaults — both for EasyPanel deploys and
local docker compose.

Drop the inline env injection in supervisord.conf since the entrypoint
now sets it. Single source of truth: the Dockerfile.

Dockerfile

@@ -64,6 +64,14 @@ COPY supervisord.conf /etc/supervisord.conf
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
+# Bake defaults that worker/beat/scanner need at runtime into the image
+# so EasyPanel deploys and local docker compose behave the same. Values
+# can still be overridden at deploy time with environment variables.
+RUN { \
+        echo 'SCANNER_SERVICE_URL=http://127.0.0.1:8001'; \
+        echo 'PYTHONUNBUFFERED=1'; \
+    } > /etc/profile.d/consentos.sh
+
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD curl -f http://localhost/health || exit 1