fix: bake SCANNER_SERVICE_URL into the combined image

Bake SCANNER_SERVICE_URL=http://127.0.0.1:8001 and PYTHONUNBUFFERED=1
into /etc/profile.d/consentos.sh inside the image and source that file
from /entrypoint.sh so every supervisord child (api, worker, beat,
scanner) inherits the same defaults — both for EasyPanel deploys and
local docker compose.

Drop the inline env injection in supervisord.conf since the entrypoint
now sets it. Single source of truth: the Dockerfile.

entrypoint.sh

@@ -1,6 +1,13 @@
 #!/bin/sh
 set -e
 
+# Source runtime defaults baked into the image so supervisord's children
+# (api, worker, beat, scanner) inherit them. Variables already set in the
+# environment take precedence — easy panel / docker compose overrides win.
+for f in /etc/profile.d/*.sh; do
+    [ -r "$f" ] && . "$f"
+done
+
 # Extract host and port from DATABASE_URL
 DB_HOST=$(echo "$DATABASE_URL" | sed -E 's|.*@([^/:]+).*|\1|')
 DB_PORT=$(echo "$DATABASE_URL" | sed -E 's|.*@[^/:]+:([0-9]+)/.*|\1|')