docs(docker): make the PowerShell key URL-safe too

Lands #1998 by @yangfan-yf-yf. Correct finding: the PowerShell example I added
in #1993 generated the administrator key with `python -c`, and the whole point
of the Docker path is that the host does not need Python. On a Windows host
without it, the very first line of the setup fails.

One thing on top. The key is also accepted as an `?api_key=` query parameter
(core/auth.py), and raw Base64 carries `+`, `/` and `=`. A `+` in a query
string decodes to a space, so a user who pasted such a key into a URL would get
a silent mismatch with nothing to explain it. The Bash line next to it uses
`secrets.token_urlsafe` and never had this shape, so the two now agree:
trim the padding, map `+` to `-` and `/` to `_`.

Verified in Windows PowerShell 5.1 (5.1.26100): the block parses and runs, and
the key is 43 URL-safe characters — the same shape `secrets.token_urlsafe(32)`
produces. validate-install-docs.py and both docker/changelog test files pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017ypcgSsh5j2PEonSJiAU1S

docs/install/docker.md

@@ -273,7 +273,19 @@ docker compose -f deploy/docker-compose.yml --profile rocm up -d
 > session before running the same two commands:
 >
 > ```powershell
-> $env:OMNIVOICE_API_KEY = python -c "import secrets; print(secrets.token_urlsafe(32))"
+> $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+> try {
+>     $keyBytes = New-Object byte[] 32
+>     $rng.GetBytes($keyBytes)
+>     # URL-safe, like the `secrets.token_urlsafe` the Bash line uses: the
+>     # key is also accepted as an `?api_key=` query parameter, where a
+>     # raw Base64 `+` decodes to a space and silently mismatches.
+>     $env:OMNIVOICE_API_KEY =
+>         [Convert]::ToBase64String($keyBytes).TrimEnd('=').Replace('+', '-').Replace('/', '_')
+> }
+> finally {
+>     $rng.Dispose()
+> }
 > $env:DOCKER_DEFAULT_PLATFORM = 'linux/amd64'
 > docker compose -f deploy/docker-compose.yml --profile cpu pull
 > docker compose -f deploy/docker-compose.yml --profile cpu up -d