Update cistech-tunnel: proper image tag, clean Dockerfile, add TOTP field

- docker-compose.json: Use git.alexzaw.dev/alexz/cistech-vpn:latest
- config.json: Add OC_TOTP_SECRET field, keep server cert as default
- Dockerfile: Remove hardcoded credentials (come from env at runtime)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/cistech-tunnel/config.json

@@ -22,14 +22,7 @@
             "type": "text",
             "env_variable": "OC_URL",
             "required": true,
-            "default": "https://vpn.cistech.net/Employees"
-        },
-        {
-            "label": "VNC Password",
-            "type": "password",
-            "env_variable": "VNC_PASSWORD",
-            "required": true,
-            "default": "Az@83278327$$@@"
+            "default": "https://vpn.example.com"
         },
         {
             "label": "Server Certificate",
@@ -42,8 +35,20 @@
             "label": "Username",
             "type": "text",
             "env_variable": "OC_USER",
-            "required": true,
-            "default": "alex.zaw@cistech.net"
+            "required": true
+        },
+        {
+            "label": "TOTP Secret",
+            "type": "password",
+            "env_variable": "OC_TOTP_SECRET",
+            "required": false,
+            "hint": "Base32 TOTP secret for auto-login"
+        },
+        {
+            "label": "VNC Password",
+            "type": "password",
+            "env_variable": "VNC_PASSWORD",
+            "required": true
         }
     ],
     "supported_architectures": [