Support `api_key_file` for docker secrets

As it says in the name, rather than having to keep the key in an env var (visible to any `docker inspect`) or in a config file (an extra place to update if it changes) allowing it to be loaded from a file means it's easier to maintain for an even more complicated compose file 😅

<https://docs.docker.com/compose/how-tos/use-secrets/>