feat: make "only the app publishes a port" a binding rule

A published database port puts the data on the public internet, and Docker's
own iptables rules bypass ufw — the server looks firewalled while the port is
open. Previously this was only a comment in compose.yaml, which an agent adding
a db service later is free to ignore.

Anchored at every point where a service could be added or shipped:
- rules/security.md: the rule, the reasoning, and the audit commands
- rules/backend.md + architecture SKILL: constraint when picking the data layer
- agents/backend-dev.md: non-negotiable for any service it adds
- agents/qa-engineer.md: a published port is a Critical finding
- skills/deploy: blocking pre-flight audit
- compose.yaml: db example now uses expose:, with depends_on healthcheck
- docs/DEPLOYMENT.md + README: SSH tunnel instead of publishing for debugging

.claude/agents/qa-engineer.md

@@ -33,6 +33,10 @@ The feature spec path and the list of previously deployed features to regression
   fallback rate-limited? A missing or weakened passkey flow is a **High** finding.
 - Injection through every user-controlled input (XSS, SQL)
 - Secrets or internal detail leaking in API responses, logs or the network tab
+- **Published ports:** run `docker compose config | grep -B8 "published:"`. Only the
+  `app` service may publish, and only on `127.0.0.1`. A database, cache or queue with
+  a published port — or anything bound to `0.0.0.0` — is a **Critical** finding: it
+  exposes the service to the internet and bypasses the host firewall.
 
 ## Tests you write
 - **Unit (Vitest), co-located in `src/`:** hooks with real logic, pure transforms,