fix: bake SCANNER_SERVICE_URL into the combined image

Bake SCANNER_SERVICE_URL=http://127.0.0.1:8001 and PYTHONUNBUFFERED=1
into /etc/profile.d/consentos.sh inside the image and source that file
from /entrypoint.sh so every supervisord child (api, worker, beat,
scanner) inherits the same defaults — both for EasyPanel deploys and
local docker compose.

Drop the inline env injection in supervisord.conf since the entrypoint
now sets it. Single source of truth: the Dockerfile.

supervisord.conf

@@ -28,10 +28,9 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=200
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:worker]
-command=sh -c "SCANNER_SERVICE_URL=http://127.0.0.1:8001 celery -A src.celery_app worker --loglevel=info --concurrency=2"
+command=celery -A src.celery_app worker --loglevel=info --concurrency=2
 directory=/app
 autostart=true
 autorestart=true
@@ -42,10 +41,9 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=30
 killasgroup=true
 priority=300
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:beat]
-command=sh -c "SCANNER_SERVICE_URL=http://127.0.0.1:8001 celery -A src.celery_app beat --loglevel=info"
+command=celery -A src.celery_app beat --loglevel=info
 directory=/app
 autostart=true
 autorestart=true
@@ -56,7 +54,6 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=400
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:scanner]
 command=python -m src.worker
@@ -71,4 +68,3 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=150
-environment=PYTHONUNBUFFERED="1"