ci: fix port 5432 collision and include read-only-prisma helper

- Remove host port mappings from postgres/redis services in ci.yml;
  QNAP runner already occupies 5432. Use service DNS names
  (postgres/redis) instead of localhost for DB/Redis URLs.
- Track packages/api/src/lib/read-only-prisma.ts which was imported
  by assistant-tools.ts but never committed, breaking check:imports.

.github/workflows/ci.yml

@@ -161,8 +161,6 @@ jobs:
           POSTGRES_DB: capakraken_test
           POSTGRES_USER: capakraken
           POSTGRES_PASSWORD: capakraken_test
-        ports:
-          - 5432:5432
         options: >-
           --health-cmd="pg_isready -U capakraken -d capakraken_test"
           --health-interval=10s
@@ -170,16 +168,14 @@ jobs:
           --health-retries=5
       redis:
         image: redis:7
-        ports:
-          - 6379:6379
         options: >-
           --health-cmd="redis-cli ping"
           --health-interval=10s
           --health-timeout=5s
           --health-retries=5
     env:
-      DATABASE_URL: postgresql://capakraken:capakraken_test@localhost:5432/capakraken_test
-      REDIS_URL: redis://localhost:6379
+      DATABASE_URL: postgresql://capakraken:capakraken_test@postgres:5432/capakraken_test
+      REDIS_URL: redis://redis:6379
       NEXTAUTH_URL: ${{ env.CI_AUTH_URL }}
       AUTH_URL: ${{ env.CI_AUTH_URL }}
       NEXTAUTH_SECRET: ${{ env.CI_AUTH_SECRET }}
@@ -286,8 +282,6 @@ jobs:
           POSTGRES_DB: capakraken_test
           POSTGRES_USER: capakraken
           POSTGRES_PASSWORD: capakraken_test
-        ports:
-          - 5432:5432
         options: >-
           --health-cmd="pg_isready -U capakraken -d capakraken_test"
           --health-interval=10s
@@ -295,18 +289,16 @@ jobs:
           --health-retries=5
       redis:
         image: redis:7
-        ports:
-          - 6379:6379
         options: >-
           --health-cmd="redis-cli ping"
           --health-interval=10s
           --health-timeout=5s
           --health-retries=5
     env:
-      DATABASE_URL: postgresql://capakraken:capakraken_test@localhost:5432/capakraken_test
+      DATABASE_URL: postgresql://capakraken:capakraken_test@postgres:5432/capakraken_test
       ALLOW_DESTRUCTIVE_DB_TOOLS: "true"
       CONFIRM_DESTRUCTIVE_DB_NAME: capakraken_test
-      REDIS_URL: redis://localhost:6379
+      REDIS_URL: redis://redis:6379
       PORT: 3100
       NEXTAUTH_URL: ${{ env.CI_AUTH_URL }}
       AUTH_URL: ${{ env.CI_AUTH_URL }}