security(docker): remove hardcoded dev password, stop placeholder secrets leaking into migrator image (#50)

- docker-compose.yml: require ${POSTGRES_PASSWORD} for the postgres service
  and the app container's DATABASE_URL. No default — compose refuses to start
  without it, mirroring the existing PGADMIN_PASSWORD pattern.
- Dockerfile.prod: move auth/db ENV assignments from persistent ENV lines into
  an inline env prefix on the `pnpm build` RUN step. Placeholders are still
  available to `next build` but no longer persist in the builder layer or in
  the published migrator image (which is FROM builder).
- Dockerfile.dev: add HEALTHCHECK against /api/health and install curl for it.
- .dockerignore: cover nested **/.env*, **/*.pem, **/*.key, **/secrets/**.
- runtime-env.ts: add the CI build placeholder strings to the disallowed-secret
  set so a misconfigured prod deploy using the baked-in ARG defaults fails
  startup instead of silently running with a known-bad secret.
- .env.example: document the new POSTGRES_PASSWORD requirement.
- CI: write POSTGRES_PASSWORD into the Fresh-Linux Docker Deploy job's .env
  (must match docker-compose.ci.yml's hardcoded DATABASE_URL), and provide a
  dummy value in the E2E job where compose validates all services' interp.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -323,6 +323,11 @@ jobs:
       # ${PGADMIN_PASSWORD:?} check fires and aborts the compose call.
       # Provide a dummy value so parsing succeeds — pgadmin is never started.
       PGADMIN_PASSWORD: ci-unused
+      # Same reason as PGADMIN_PASSWORD: docker compose validates env
+      # interpolation across all services, including postgres (which has
+      # ${POSTGRES_PASSWORD:?}). Dummy value — postgres service is not used
+      # here (the `e2epg` GH Actions service container is).
+      POSTGRES_PASSWORD: ci-unused
       # Tell test-server.mjs not to spin up its own postgres-test container
       # — the e2epg job service is already running and reachable. Without
       # this, test-server tries to publish 5432 on the QNAP host, which
@@ -462,6 +467,9 @@ jobs:
           NEXTAUTH_URL=http://localhost:3100
           NEXTAUTH_SECRET=ci-test-secret-minimum-32-chars-xx
           PGADMIN_PASSWORD=ci-pgadmin
+          # Must match the password baked into docker-compose.ci.yml's
+          # DATABASE_URL override (capakraken_dev).
+          POSTGRES_PASSWORD=capakraken_dev
           EOF
 
       - name: Tear down any stale stack & volumes