ci(obs): add compose config dry-run before obs stack up to catch .env substitution errors

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/nightly.yml

@@ -143,6 +143,16 @@ jobs:
           cp -r infra/observability /opt/familienarchiv/infra/
           cp docker-compose.observability.yml /opt/familienarchiv/
 
+      - name: Validate observability compose config
+        # Dry-run: resolves all variable substitutions from /opt/familienarchiv/.env
+        # and reports any missing required keys before containers start. Catches
+        # truncated passwords (missing $$ escaping), undefined variables, and YAML
+        # errors in config files updated by the previous step.
+        run: |
+          docker compose \
+            -f /opt/familienarchiv/docker-compose.observability.yml \
+            config --quiet
+
       - name: Start observability stack
         # Runs from /opt/familienarchiv/ so bind mounts resolve to stable
         # host paths that survive workspace wipes between nightly runs.