Run containers on Mountain time (TZ=America/Denver or host /etc/localtime)

Images with zoneinfo get TZ=America/Denver; images without it mount the
host zone file read-only (TZ= would silently fall back to UTC there).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -4,6 +4,7 @@ services:
     container_name: basil-postgres
     restart: unless-stopped
     environment:
+      TZ: America/Denver
       POSTGRES_USER: basil
       POSTGRES_PASSWORD: basil
       POSTGRES_DB: basil
@@ -51,6 +52,7 @@ services:
       APP_URL: ${APP_URL:-https://basil.pkartchner.com}
       API_URL: ${API_URL:-https://basil.pkartchner.com}
     volumes:
+      - /etc/localtime:/etc/localtime:ro   # image has no zoneinfo; TZ= would fall back to UTC
       - uploads_data:/app/uploads
       - backups_data:/app/backups
     networks:
@@ -64,6 +66,8 @@ services:
       dockerfile: packages/web/Dockerfile
     container_name: basil-web
     restart: unless-stopped
+    environment:
+      TZ: America/Denver
     depends_on:
       - api
     networks:
@@ -79,7 +83,7 @@ services:
       - "traefik.http.routers.basil.rule=Host(`basil.pkartchner.com`)"
       - "traefik.http.routers.basil.entrypoints=https"
       - "traefik.http.routers.basil.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.basil.middlewares=geoblock@file,secure-headers@file,crowdsec-bouncer@file"
+      - "traefik.http.routers.basil.middlewares=geoblock@file,secure-headers@file,crowdsec-bouncer@docker"
       # Service
       - "traefik.http.services.basil.loadbalancer.server.port=80"
       - "traefik.docker.network=traefik"