Pin Minecraft 26.3 and add safe Orion managed deployment support

.env.example

@@ -6,7 +6,7 @@
 
 # ── Minecraft ────────────────────────────────────────────────────────────
 # Game version. Change and re-run `docker compose up -d mc` to upgrade.
-MC_VERSION=26.2
+MC_VERSION=26.3
 # Loader: FABRIC (default), NEOFORGE, FORGE, VANILLA, PAPER, ...
 SERVER_TYPE=FABRIC
 # JVM heap for the server. Host has 10 GB → 6G heap / 7g container limit.
@@ -25,10 +25,8 @@ MC_SIMULATION_DISTANCE=8
 MC_SEED=
 
 # Server-side mods (Modrinth project slugs, comma-separated).
-# Auto-resolved to the newest compatible release on every container start.
-# Append ":beta" to allow beta-typed builds for a project (EasyAuth ships
-# its 26.x builds as beta on Modrinth).
-MODRINTH_PROJECTS=fabric-api,easyauth:beta,spark,lithium,ferrite-core
+# Exact version IDs are locked. Review all IDs before upgrading Minecraft.
+MODRINTH_PROJECTS=fabric-api:bNnaTiuM,easyauth:Qd0CWVQP,spark:e3hsPc1o,lithium:xS0Q8LSi,ferrite-core:d5ddUdiB
 # To run a full modpack instead, set its Modrinth slug (e.g. adrenaline)
 # and see docs/mods-and-modpacks.md before enabling.
 MODRINTH_MODPACK=
@@ -40,6 +38,9 @@ PANEL_SESSION_SECRET=CHANGE_ME
 # you are forced to change it in the UI afterwards.
 PANEL_ADMIN_PASSWORD=CHANGE_ME
 
+# Absolute checkout path on the Docker host (setup.sh fills this in).
+PROJECT_DIR=
+
 # ── Dashboard ────────────────────────────────────────────────────────────
 DASHBOARD_PORT=8080
 # Minutes an approved player has to /register before approval expires