feat: make "only the app publishes a port" a binding rule

A published database port puts the data on the public internet, and Docker's
own iptables rules bypass ufw — the server looks firewalled while the port is
open. Previously this was only a comment in compose.yaml, which an agent adding
a db service later is free to ignore.

Anchored at every point where a service could be added or shipped:
- rules/security.md: the rule, the reasoning, and the audit commands
- rules/backend.md + architecture SKILL: constraint when picking the data layer
- agents/backend-dev.md: non-negotiable for any service it adds
- agents/qa-engineer.md: a published port is a Critical finding
- skills/deploy: blocking pre-flight audit
- compose.yaml: db example now uses expose:, with depends_on healthcheck
- docs/DEPLOYMENT.md + README: SSH tunnel instead of publishing for debugging

.claude/skills/architecture/SKILL.md

@@ -41,8 +41,10 @@ This template deliberately ships **no** database or ORM. Decide per feature:
 > es eine Datenbank im Compose-Stack.
 
 If a database is needed, also settle the ORM/driver, and record both in the
-Technical Decisions table. Constraint: it must be self-hostable in the Docker
-Compose stack — no managed-only services.
+Technical Decisions table. Two constraints: it must be self-hostable in the Docker
+Compose stack (no managed-only services), and it runs **without a published port** —
+only the app is reachable from outside, everything else talks over the internal
+compose network.
 
 ### Authentication