feat: make "only the app publishes a port" a binding rule

A published database port puts the data on the public internet, and Docker's
own iptables rules bypass ufw — the server looks firewalled while the port is
open. Previously this was only a comment in compose.yaml, which an agent adding
a db service later is free to ignore.

Anchored at every point where a service could be added or shipped:
- rules/security.md: the rule, the reasoning, and the audit commands
- rules/backend.md + architecture SKILL: constraint when picking the data layer
- agents/backend-dev.md: non-negotiable for any service it adds
- agents/qa-engineer.md: a published port is a Critical finding
- skills/deploy: blocking pre-flight audit
- compose.yaml: db example now uses expose:, with depends_on healthcheck
- docs/DEPLOYMENT.md + README: SSH tunnel instead of publishing for debugging

.claude/skills/architecture/SKILL.md

@@ -41,8 +41,10 @@ This template deliberately ships **no** database or ORM. Decide per feature:
 > es eine Datenbank im Compose-Stack.
 
 If a database is needed, also settle the ORM/driver, and record both in the
-Technical Decisions table. Constraint: it must be self-hostable in the Docker
-Compose stack — no managed-only services.
+Technical Decisions table. Two constraints: it must be self-hostable in the Docker
+Compose stack (no managed-only services), and it runs **without a published port** —
+only the app is reachable from outside, everything else talks over the internal
+compose network.
 
 ### Authentication
 

.claude/skills/deploy/SKILL.md

@@ -36,6 +36,18 @@ Then check:
 - [ ] Pending migrations are committed
 - [ ] Everything committed and pushed to the remote the server pulls from
 
+**Port audit — blocking.** Only the app service may publish a port, and only on
+loopback:
+
+```bash
+docker compose config | grep -B8 "published:"
+```
+
+Any service other than `app` with a published port, or any binding to `0.0.0.0`,
+stops the deploy. A published database port puts the data on the public internet and
+bypasses ufw, because Docker writes its own iptables rules. Fix `compose.yaml`
+before continuing.
+
 ## 3. First deployment only
 
 Walk the user through this once. It happens on the server, over SSH.