fix: correct permission checks for compose loadServices and env editing

- Change compose.loadServices permission from service:create to service:read
  since loading services from a compose file is a read-only operation
- Add saveEnvironment endpoint to compose router with envVars:write permission
- Update show-environment.tsx to use saveEnvironment mutations instead of
  generic update mutations for all service types (compose, databases)

Closes #4052

packages/server/src/db/schema/compose.ts

@@ -225,6 +225,13 @@ export const apiUpdateCompose = createSchema
 	})
 	.omit({ serverId: true });
 
+export const apiSaveEnvironmentVariablesCompose = createSchema
+	.pick({
+		composeId: true,
+		env: true,
+	})
+	.required();
+
 export const apiRandomizeCompose = createSchema
 	.pick({
 		composeId: true,