security(docker): remove hardcoded dev password, stop placeholder secrets leaking into migrator image (#50)

- docker-compose.yml: require ${POSTGRES_PASSWORD} for the postgres service
  and the app container's DATABASE_URL. No default — compose refuses to start
  without it, mirroring the existing PGADMIN_PASSWORD pattern.
- Dockerfile.prod: move auth/db ENV assignments from persistent ENV lines into
  an inline env prefix on the `pnpm build` RUN step. Placeholders are still
  available to `next build` but no longer persist in the builder layer or in
  the published migrator image (which is FROM builder).
- Dockerfile.dev: add HEALTHCHECK against /api/health and install curl for it.
- .dockerignore: cover nested **/.env*, **/*.pem, **/*.key, **/secrets/**.
- runtime-env.ts: add the CI build placeholder strings to the disallowed-secret
  set so a misconfigured prod deploy using the baked-in ARG defaults fails
  startup instead of silently running with a known-bad secret.
- .env.example: document the new POSTGRES_PASSWORD requirement.
- CI: write POSTGRES_PASSWORD into the Fresh-Linux Docker Deploy job's .env
  (must match docker-compose.ci.yml's hardcoded DATABASE_URL), and provide a
  dummy value in the E2E job where compose validates all services' interp.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -21,10 +21,17 @@ NEXTAUTH_SECRET=
 
 # ─── Database ────────────────────────────────────────────────────────────────
 
-# REQUIRED — PostgreSQL connection string.
-# When running with Docker Compose the app container uses the Docker-internal
-# host (postgres:5432); the host-level connection (for pnpm dev on the host)
-# uses localhost:5433 (the published port).
+# REQUIRED when starting Docker Compose — postgres container initializes with
+# this password and the app container derives DATABASE_URL from it. No default
+# is shipped; set any non-empty value for local dev, use a generated secret in
+# any shared or production environment.
+# Generate one with: openssl rand -hex 32
+POSTGRES_PASSWORD=
+
+# REQUIRED — PostgreSQL connection string used by `pnpm dev` running on the
+# host (outside Docker). Must match POSTGRES_PASSWORD above. Inside the app
+# container this variable is overridden by docker-compose.yml (which routes
+# to the postgres service name on the internal network).
 DATABASE_URL=postgresql://capakraken:capakraken_dev@localhost:5433/capakraken
 
 # ─── Redis ───────────────────────────────────────────────────────────────────