feat: make "only the app publishes a port" a binding rule

A published database port puts the data on the public internet, and Docker's
own iptables rules bypass ufw — the server looks firewalled while the port is
open. Previously this was only a comment in compose.yaml, which an agent adding
a db service later is free to ignore.

Anchored at every point where a service could be added or shipped:
- rules/security.md: the rule, the reasoning, and the audit commands
- rules/backend.md + architecture SKILL: constraint when picking the data layer
- agents/backend-dev.md: non-negotiable for any service it adds
- agents/qa-engineer.md: a published port is a Critical finding
- skills/deploy: blocking pre-flight audit
- compose.yaml: db example now uses expose:, with depends_on healthcheck
- docs/DEPLOYMENT.md + README: SSH tunnel instead of publishing for debugging

compose.yaml

@@ -32,8 +32,13 @@ services:
         max-file: "3"
 
 # A database is deliberately not part of this template — /architecture picks one
-# per project. When you add one, declare it here as a second service, put it on
-# an internal network without a published port, and add its volume below.
+# per project.
+#
+# RULE FOR EVERY SERVICE ADDED BELOW: only `app` gets a `ports:` entry. Databases,
+# caches and queues get none — the app reaches them by service name over this
+# compose network (`db:5432`). Publishing 5432 puts the database on the public
+# internet, and Docker's iptables rules bypass ufw, so the server only *looks*
+# firewalled. See .claude/rules/security.md.
 #
 #  db:
 #    image: postgres:17-alpine
@@ -41,8 +46,21 @@ services:
 #    environment:
 #      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
 #      POSTGRES_DB: ${POSTGRES_DB:-app}
+#    expose:
+#      - "5432"        # documentation only — NOT reachable from the host
 #    volumes:
 #      - db-data:/var/lib/postgresql/data
+#    healthcheck:
+#      test: ["CMD-SHELL", "pg_isready -U postgres"]
+#      interval: 10s
+#      timeout: 5s
+#      retries: 5
+#
+# Then make the app wait for it:
+#  app:
+#    depends_on:
+#      db:
+#        condition: service_healthy
 #
 # volumes:
 #   db-data: