Drop .env handling, fix default dataset, update README

- Remove .env.example and its .gitignore entry; compose sets the
  dev credentials directly. Basic auth in the image is unchanged.
- Preselect the last dataset by name instead of by mtime, which is
  meaningless after a git checkout in CI
- README: Esc zoom reset, data update flow, data visibility note,
  runner image requirements, dev login for compose
- Remove duplicate data/history2.csv

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -3,7 +3,8 @@
 A small static web app that visualises when a heat pump compressor is running,
 based on Home Assistant history exports (`binary_sensor.*` on/off states).
 
-- Interactive timeline (pan, zoom, mouse-wheel, quick ranges 6 h / 24 h / 3 d / 7 d)
+- Interactive timeline (pan, zoom, mouse-wheel, quick ranges 6 h / 24 h / 3 d / 7 d;
+  double-click or Esc resets the zoom)
 - Hover an on-phase to see its start, end and duration
 - Statistics for the visible range: number of phases, min / max / mean / median
   duration, total on-time, duty cycle, mean pause between phases
@@ -20,13 +21,18 @@ Put CSV exports into `data/`. Every `*.csv` in there is baked into the image.
 
 - **One file:** it is loaded directly.
 - **Several files:** a dropdown in the header lists them alphabetically. The
-  most recently modified file (or the viewer's last choice) is preselected.
+  viewer's last choice is preselected, otherwise the **last file by name**.
+  Name files by date (`2026-09.csv`, `2026-10.csv`, …) so the newest comes last.
 
 A different CSV can also be opened ad hoc with **Load CSV…**. It is parsed in
 the browser and not uploaded.
 
 The file list comes from nginx's JSON directory listing of `/data/`, so nothing
-has to be registered anywhere. Add or remove files and rebuild the image.
+has to be registered anywhere. To add or remove files, commit and push; CI
+builds a new image. Locally, use `docker compose up -d --build`.
+
+> The data is part of the image. Anyone who can pull the image (or read this
+> repository) can read the CSVs; basic auth only protects the running web app.
 
 ### CSV format
 
@@ -76,11 +82,12 @@ the app without a password.
 ### Local run with Compose
 
 ```sh
-cp .env.example .env   # set BASIC_AUTH_USER / BASIC_AUTH_PASSWORD
 docker compose up -d --build
 ```
 
-Open <http://localhost:8080> (port configurable with `HEATPUMP_PORT`).
+Open <http://localhost:8080> and log in as `dev` / `dev`. These development
+credentials are set in `docker-compose.yml`. The host port can be changed with
+`HEATPUMP_PORT=9000 docker compose up -d`.
 
 ## CI: build and push
 
@@ -102,7 +109,9 @@ Setup:
    - `REGISTRY_TOKEN`: that robot account's secret
 2. A runner with Docker access must be registered for the repo, user or
    instance (`act_runner` with the Docker socket mounted), and it must provide
-   the `ubuntu-latest` label.
+   the `ubuntu-latest` label. The job image needs Node 20 and the Docker CLI,
+   e.g. `docker.gitea.com/runner-images:ubuntu-latest`. The old default
+   `node:16-bullseye` fails on `actions/checkout@v4`.
 
 ## Project layout