feat: update.sh force-syncs tracked config from .env.example

Follows directly from the previous commit's caveat: this PR's own fix
(LLAMA_FAST_PARALLEL=2 -> 1) wouldn't have taken effect on the server
without a manual .env edit, because set_if_blank never touches an
already-set value — by design, for secrets, but the same logic was
silently protecting stale copies of ordinary tunable config too.

Every KEY=VALUE line in .env.example with a real (non-blank) default
is now force-synced into .env on every run. Secrets and host-resolved
values are unaffected — .env.example already leaves those blank on
purpose, so the sync loop naturally skips them and they keep going
through set_if_blank as before.

Trade-off, called out in both the script's header and the sync loop's
own comment: there's no such thing as a persistent server-only
override for these keys anymore — a hand-edited value not reflected
in git gets reverted on the next run. That's the intended behavior.

Verified against a simulated stale .env matching the real scenario
from this PR: LLAMA_FAST_PARALLEL correctly overwritten 2 -> 1, an
OMNIROUTE secret left untouched. bash -n and docker compose config -q
both pass.

Refs #5

scripts/update.sh

@@ -4,6 +4,13 @@
 # exist, pulls, validates, rebuilds/re-pulls images, and recreates only what
 # changed — safe to run any time, including with nothing to do.
 #
+# Tunable config values (LLAMA_*, ports, timeouts — anything with a real
+# default in .env.example) are force-synced from .env.example every run,
+# not just filled in when missing — see the sync loop below. Only actual
+# secrets and host-resolved values (blank in .env.example) survive a
+# server-side edit; there's no persistent server-only override for
+# anything else.
+#
 # omniroute's own routing/provider config (llama-server, search) lives in
 # its dashboard, not a checked-in file like the old litellm-config.yaml —
 # see issue #31 and docs/proxy-key-onboarding.md.
@@ -27,6 +34,29 @@ git pull --ff-only
 
 [ -f .env ] || cp .env.example .env
 
+echo "==> syncing tracked config values from .env.example"
+# Every KEY=VALUE line in .env.example that has a real default (not
+# blank) is ordinary tunable config, not a secret or host-specific
+# value — .env.example itself already draws that line: secrets
+# (OMNIROUTE_*_SECRET/_KEY/_SALT/_PASSWORD) and host-resolved values
+# (SEARXNG_LAN_IP, COMFYUI_PUID/PGID, HOST_VIDEO_GID/RENDER_GID) are
+# all left blank there on purpose, so this loop naturally skips them —
+# they keep going through set_if_blank below instead. This force-
+# overwrites .env with whatever's in git on every run, so a value
+# hand-edited on the server (not in .env.example) gets silently
+# reverted on the next update.sh — that's the point (git pull #48 bit
+# us exactly because a stale .env value survived a code change and
+# broke llama-server-fast, see #5/#49), but it means there's no such
+# thing as a persistent server-only override for these keys anymore.
+while IFS='=' read -r key value; do
+  [ -n "$value" ] || continue
+  if grep -qE "^${key}=" .env; then
+    sed -i "s|^${key}=.*|${key}=${value}|" .env
+  else
+    echo "${key}=${value}" >> .env
+  fi
+done < <(grep -E '^[A-Za-z_][A-Za-z0-9_]*=.+' .env.example)
+
 # Handles all three cases: the KEY=value line is missing entirely (.env
 # predates that var being added to .env.example — sed can't fix what isn't
 # there, so this appends it), present but blank, or already set.