authenticate outgoing lichess.org requests to fix silent 404s on games/user

Lichess started rejecting anonymous requests to games/user and
user/activity with a 404 (confirmed live: the same request with a valid
bearer token got a normal 429 instead), which our code silently read as
"user has no games" for every single tracked player, making periodic
checks report zero activity across the board. Add LICHESS_APP_TOKEN and
send it as a Bearer token on these two calls; it just needs to be any
valid token; it does not need to belong to the tracked player.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -4,6 +4,8 @@ services:
     container_name: lichess-api
     ports:
       - "8002:8000"
+    env_file:
+      - .env
     environment:
       - PYTHONUNBUFFERED=1
     restart: always