Add ENCRYPTION_KEY_CHECK=warn as an escape hatch for the boot key check

At a first start there is no recorded key yet, so an operator facing a
refusal they are certain is false has no row to delete. With
ENCRYPTION_KEY_CHECK=warn (default enforce) the check still runs and logs
its full outcome, /api/health names a mismatch as a warning field without
failing, requests are served, and no key is recorded unless every key id
passes.

The variable is on the compose whitelist, in both example files, the env
manifest, the Unraid and Portainer templates and the published-env guard.
The log block, the mismatch page and the self-hosting pages offer it as the
last resort after the three real fixes, and say that it disables a safety
check.

.env.example

@@ -67,6 +67,13 @@ NODE_ENV="development"
 # your encryption key" step shows first; unset means compose.
 # HEALTHLOG_PLATFORM="compose"
 
+# Start-up encryption key check: enforce (default) refuses to serve when the
+# key does not open the stored data; warn only logs it and serves anyway. A
+# last resort for a refusal you are certain is false (a first start, with no
+# recorded key to reset). It disables a safety check: with a wrong key every
+# encrypted value fails and new rows are written under that key.
+# ENCRYPTION_KEY_CHECK="enforce"
+
 
 # -----------------------------------------------------------------------------
 # Required Secrets — generate with `openssl rand -hex 32`