Disable enforce-secure-profile so offline-launcher players can join

EasyAuth flagged it at startup: with enforce-secure-profile on (vanilla
default), TLauncher/offline clients are rejected before they can even
authenticate. Set ENFORCE_SECURE_PROFILE=FALSE on the mc service and
document the symptom in troubleshooting.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -16,8 +16,11 @@ services:
       MEMORY: ${MC_MEMORY:-6G}
       USE_AIKAR_FLAGS: "true"
 
-      # Offline mode + whitelist as the approval gate (see docs/auth-flow.md)
+      # Offline mode + whitelist as the approval gate (see docs/auth-flow.md).
+      # enforce-secure-profile must be off or offline-launcher players are
+      # rejected before EasyAuth can even prompt them (EasyAuth issue #68).
       ONLINE_MODE: "FALSE"
+      ENFORCE_SECURE_PROFILE: "FALSE"
       ENABLE_WHITELIST: "TRUE"
       ENFORCE_WHITELIST: "TRUE"