Local docs: the Linux docker group, and the "variable is not set" warnings

Two things a fresh Linux install runs into. Docker Engine only answers
members of the docker group, which the "no admin account needed" tip
glossed over since it was written for Docker Desktop. And CLI versions
up to 3.17.1 could write a '$' into the signing keys in .env, which
Compose interpolates away with one warning per key.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: onekiloparsec

docs/local/installation.md

@@ -49,6 +49,15 @@ Two frequent worries, both unfounded:
 - **You do not need a Docker account** to run Arcsecond.local. Docker Desktop shows a sign-in screen on first
   launch — you can simply skip it. The only login involved is the one to the *Arcsecond* registry with your PAT,
   described below, which is unrelated to Docker Hub.
+
+One exception, on **Linux with Docker Engine** (no Docker Desktop): the daemon only answers root and members of the
+`docker` group. If `docker compose up -d` ends with `permission denied while trying to connect to the docker API at
+unix:///var/run/docker.sock`, add your user to that group once, then log out and back in (or open a new shell with
+`newgrp docker`):
+
+```bash
+sudo usermod -aG docker $USER
+```
 :::
 
 ## Installation

docs/local/troubleshooting.md

@@ -13,4 +13,32 @@
 - Confirm the mount from inside a container (quick sanity check): Run a one-off container that writes a test file to
   /data and confirm the file appears on the host. If it can’t write, it’s almost always a sharing/permissions/path
   issue.
-  
+  
+
+## Linux: "permission denied while trying to connect to the docker API"
+
+The full line is `permission denied while trying to connect to the docker API at unix:///var/run/docker.sock`, and it
+shows up right after `docker compose up -d` on a Linux host running Docker Engine (not Docker Desktop). The daemon only
+answers root and members of the `docker` group, and a fresh install does not put your user there. `docker login`
+succeeds regardless, because it only writes a config file, which is why the failure looks sudden.
+
+Add your user to the group once, then log out and back in (or `newgrp docker` in the current shell), and check with
+`docker ps` before running `docker compose up -d` again:
+
+```bash
+sudo usermod -aG docker $USER
+```
+
+## "The 'xyz' variable is not set. Defaulting to a blank string."
+
+Repeated `WARN[0000] The "..." variable is not set` lines on `docker compose up`, with names that look like random
+fragments, come from a `$` inside one of the secret keys that `arcsecond setup` wrote to `.env`. Compose interpolates
+`$name` in that file, so the `$` and the characters after it are dropped. Versions of the CLI up to 3.17.1 could
+generate such keys; later versions do not.
+
+The containers all see the same shortened value, so an installation that runs with these warnings is fine as it is.
+On a **brand new** installation that has not started yet, the cleaner move is to open `.env` and remove every `$` from
+`SECRET_KEY`, `AUTH_JWT_SIGNING_KEY` and `AGENT_JWT_SIGNING_KEY` (or delete `.env` and rerun `arcsecond setup` with an
+up-to-date CLI). Do not touch these three keys on an installation that already has users: they sign every session
+token, and changing them logs everyone out.
+