Let docker-install.sh take its three answers up front

The script asked three questions with no way to answer them in advance,
so a Docker container could not be deployed unattended: Portainer, the
Portainer Agent, and whether to expose the TCP socket.

Each now reads a variable and prompts only when it is unset, the same
shape install/forgejo-runner-install.sh already uses:

  var_portainer         yes | no
  var_portainer_agent   yes | no
  var_docker_socket     n | l (127.0.0.1) | a (0.0.0.0)

Interactive behaviour is unchanged — with nothing set, all three still
ask exactly as before.

The matching declaration for the script's PocketBase record, which the
website generator reads to offer these as form fields:

  "app_vars": [
    {"name":"var_portainer","label":"Install Portainer","type":"boolean","default":"no"},
    {"name":"var_portainer_agent","label":"Install Portainer Agent","type":"boolean","default":"no",
     "help":"Only used when Portainer itself is not installed"},
    {"name":"var_docker_socket","label":"Expose Docker TCP socket","type":"select",
     "options":["n","l","a"],"default":"n",
     "help":"l = 127.0.0.1 only, a = all interfaces (insecure)"}
  ]

CONTRIBUTING.md documents the convention so the next script follows it.

CONTRIBUTING.md

@@ -103,6 +103,47 @@ Key rules at a glance:
 - Quote all variables: `"$VAR"` not `$VAR`
 - Use lowercase variable names
 - Do not hardcode credentials or sensitive values
+- Never prompt without an escape hatch — see below
+
+### Answering a prompt up front
+
+An install script that only asks cannot be deployed unattended. Read the
+variable first and prompt only when it is unset:
+
+```bash
+if [[ -z "${var_admin_user:-}" ]]; then
+  read -r -p "${TAB3}Admin username: " var_admin_user
+fi
+var_admin_user="${var_admin_user:-admin}"
+```
+
+Name them `var_<something>`, the same namespace the container variables use.
+`install/forgejo-runner-install.sh` and `install/docker-install.sh` both follow
+this.
+
+Declare them on the script's PocketBase record in `app_vars` so the website's
+generator can offer them as fields:
+
+```json
+"app_vars": [
+  {
+    "name": "var_admin_user",
+    "label": "Admin Username",
+    "type": "text",
+    "default": "admin"
+  },
+  {
+    "name": "var_admin_pass",
+    "label": "Admin Password",
+    "type": "password",
+    "secret": true
+  }
+]
+```
+
+`type` is one of `text`, `password`, `number`, `boolean` (`yes`/`no`) or
+`select` (with `options`). Mark anything credential-like `secret` — the
+generator keeps those out of shareable links and out of the on-screen summary.
 
 Full standards and examples: **[community-scripts.org/docs/contribution](https://community-scripts.org/docs/contribution)**