fix(payments): provision BOTFIGHTS_WALLET_ENCRYPTION_KEY on the canonical arena

"Connect NWC" was 500ing — server/src/engine/crypto.ts's getKey() throws
immediately under NODE_ENV=production when this var is unset. Generated a
random 32-byte key directly on the VPS2 host into /opt/botfights-arena/.env
(0600, never committed — same pattern as JWT_SECRET), wired the reference
into the deployed docker-compose.yml, and restarted. Only enables storing
per-user NWC connection strings encrypted at rest — does not enable any
actual money movement (BOTFIGHTS_NWC_URL, the arena's own wallet, is still
unset and deliberately not touched here).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.arena.yml

@@ -52,10 +52,19 @@ services:
       # Deliberately OMITTED: this instance IS the upstream — never point it at
       # another arena.
       # - ARENA_UPSTREAM_URL=
-      # ── Payments are OUT OF SCOPE for this deployment (phase 09 CONTEXT.md
-      #    scope fence: "OUT: Lightning/cashu payment changes"). Do not set:
-      # - BOTFIGHTS_WALLET_ENCRYPTION_KEY=
-      # - BOTFIGHTS_NWC_URL=
+      # Encrypts stored per-user NWC connection strings at rest (AES-256-GCM,
+      # server/src/engine/crypto.ts) — without it, "Connect NWC" 500s
+      # immediately (getKey() throws under NODE_ENV=production). Generated on
+      # the host into /opt/botfights-arena/.env (0600, never committed),
+      # same pattern as JWT_SECRET above.
+      - BOTFIGHTS_WALLET_ENCRYPTION_KEY=${BOTFIGHTS_WALLET_ENCRYPTION_KEY}
+      # Actual money movement is still deliberately NOT enabled (phase 09
+      # CONTEXT.md scope fence: "OUT: Lightning/cashu payment changes" — the
+      # encryption key above only lets per-user wallet strings be stored, it
+      # doesn't move any funds on its own). A Cashu-based fixed-stake
+      # ("winner takes all, 21 sats") entry-fee design is being scoped
+      # separately before any of these are set:
+      # - BOTFIGHTS_NWC_URL=              (the ARENA's OWN wallet — real funds)
       # - BOTFIGHTS_CASHU_MINT_URL=
       # - BOTFIGHTS_DEV_PAYOUT_LNADDRESS=