operator-plane: fix dashboard POST NameError (import os/hmac)

Every POST endpoint (approve/reject/exit/watch) crashed with NameError:
do_POST references os.environ + hmac.compare_digest but neither was imported.
Adds the imports, a non-loopback regression test for the token gate (no token
-> routes; token set -> 401 without/with-wrong header, 200 with correct), and
plumbs DASHBOARD_TOKEN + PG_SKIP_SCHEMA=1 into both compose dashboard services
(+ .env.example docs for DASHBOARD_TOKEN / COMMAND_BUS_ENABLED).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/docker/truenas-compose.yml

@@ -156,8 +156,15 @@ services:
       <<: *app-env
       DASHBOARD_HOST: "0.0.0.0"
       DASHBOARD_PORT: "8765"
-    ports:
-      - "8765:8765"
+      # read-only viewer: never re-apply the 473-line schema (the SSE change
+      # detector holds one long-lived connection) — mirrors the loop healthcheck.
+      PG_SKIP_SCHEMA: '1'
+      # Shared secret required on every POST (approve/reject/exit + the command
+      # bus). Empty = commands disabled + POSTs unauthenticated; fill to arm the
+      # kill switch. Reference by name only — never inline the secret value.
+      DASHBOARD_TOKEN: <FILL-ME-DASHBOARD-TOKEN>
+      # Gate the operator command bus on (also needs DASHBOARD_TOKEN set).
+      COMMAND_BUS_ENABLED: '1'
 
   qabot:
     <<: *app