security(deploy): harden Docker Compose, PgBouncer, and production image defaults #682

Parent epic: #679
Related historical deployment issue: #408

Evidence

Current defaults expose PostgreSQL 5432:5432 and PgBouncer 6432:6432; PgBouncer listens on 0.0.0.0, uses md5 auth, and references a mutable latest image. The app image/runtime also installs/builds at startup rather than using a frozen immutable artifact.

Objective

Provide secure production defaults while retaining an explicit localhost-only development profile.

Scope

• Make database/PgBouncer internal-only by default; bind development ports to localhost in a separate profile.
• Pin Bun, PostgreSQL, PgBouncer, and action/image versions or digests.
• Move to SCRAM-compatible authentication and documented TLS/trust boundaries.
• Build an immutable image with frozen lockfile and no startup dependency install/build.
• Run non-root; add health checks, read-only filesystem where feasible, cap_drop, tmpfs, and resource limits.
• Ensure secrets use deployment secret references rather than committed files.
• Update Coolify/VPS/offline-LAN deployment docs and checks.

Acceptance criteria

• Production compose exposes only the application/reverse-proxy interface required by the topology.
• Development exposure is localhost-only and opt-in.
• Runtime image is reproducible from the lockfile and contains no build toolchain not needed at runtime.
• PgBouncer auth and health checks work with separated DB roles.
• Container security settings are verified in CI or a deployment smoke test.
• Offline/LAN deployment remains possible without external services.