fix(docker): preserve trailing = in env values on su reload (#7432)

docker_init.bash load_env() reloaded the save_env() snapshot after the
su privilege drop with `while IFS='=' read -r key value`, and Bash
silently drops a single trailing `=` from the last field. Any secret
ending in one `=` (openssl rand -base64 32 output is 44 chars ending in
`=`) reloaded one character short, breaking shared-secret auth and
HERMES_WEBUI_PASSWORD matching in the container.

Read each line whole (`IFS= read -r line`) then split at the FIRST `=`
only (key=${line%%=*}, value=${line#*=}), preserving embedded and
trailing `=`. Blank and comment lines are skipped; lines without `=`
keep prior empty-value behavior.

Closes #7432.

Co-authored-by: webtecnica <webtecnica@gmail.com>

docker_init.bash

@@ -169,7 +169,26 @@ load_env() {
   obfuscate_part="${ENV_OBFUSCATE_PART}"
   if [ -f "$tocheck" ]; then
     echo "-- Loading environment variables from $tocheck (overwrite existing: $overwrite_if_different) (ignorelist: $ignore_list) (obfuscate: $obfuscate_part)"
-    while IFS='=' read -r key value; do
+    # Read whole lines, then split at the FIRST '=' only. Splitting on every
+    # '=' (IFS='=' read -r key value) makes read drop a single trailing '='
+    # from values, corrupting secrets such as openssl rand -base64 32 output
+    # (44 chars ending in '=').
+    while IFS= read -r key; do
+      # Skip empty lines and comment lines.
+      case "$key" in
+        ''|\#*) continue ;;
+      esac
+      if [[ "$key" == *=* ]]; then
+        # Split at the FIRST '=' only. Derive value before shortening key,
+        # since ${key%%=*} mutates key. Reusing the existing 'key' read
+        # target (rather than a new 'line' var) avoids silently clobbering a
+        # user env var named 'line' on the post-su reload.
+        value=${key#*=}
+        key=${key%%=*}
+      else
+        # Line without '=': whole line is the key with an empty value.
+        value=
+      fi
       doit=false
       # checking if the key is in the ignorelist
       for i in $ignore_list; do