🐐 Docker compose fix

docker-compose.yml

@@ -1,15 +1,3 @@
-# wiki-tcg — replaces the previous docker-compose.yml, which did not describe
-# the deployment (findings-02 §5.4).
-#
-# Networks:
-#   proxy        - shared, created outside compose. NPM meets front-facing
-#                  containers here. Also used by other stacks later.
-#   tcg-internal - private. Only the backend and the database. Marked internal,
-#                  so the database has no route off this network at all.
-#
-# Deploy:  docker compose up -d --build
-# Migrate: docker compose run --rm backend alembic upgrade head
-
 services:
   db:
     image: postgres:16
@@ -18,16 +6,13 @@ services:
     environment:
       POSTGRES_DB: wikitcg
       POSTGRES_USER: wikitcg
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
       PGDATA: /var/lib/postgresql/data
       TZ: Europe/Paris
     volumes:
-      # EXACT path from the running container. /mnt/cache, NOT /mnt/user —
-      # this deliberately bypasses Unraid's FUSE layer. Do not "correct" it.
       - /mnt/cache/appdata/postgresql16:/var/lib/postgresql/data
     networks:
       - tcg-internal
-    # No ports. The database is unreachable from the host and the LAN.
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U wikitcg -d wikitcg"]
       interval: 10s
@@ -43,10 +28,7 @@ services:
     container_name: wikitcg-backend
     restart: unless-stopped
     environment:
-      # Runtime connection — DML only, cannot alter schema.
       DATABASE_URL: postgresql://wikitcg_app:${APP_DB_PASSWORD:?}@db:5432/wikitcg
-      # Migrations only. Owns the schema. Used by `compose run`, never by the
-      # running app. See tcg-remediation-todo.md Task 5.
       MIGRATION_DATABASE_URL: postgresql://wikitcg:${POSTGRES_PASSWORD:?}@db:5432/wikitcg
       JWT_SECRET_KEY: ${JWT_SECRET_KEY:?}
       STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:?}
@@ -59,11 +41,8 @@ services:
       WIKIRANK_USER_AGENT: WikiTCG/1.0 (nikolaj@gade.gg)
       TZ: Europe/Paris
     networks:
-      - tcg-internal    # to reach db
-      - proxy           # to be reached by NPM
-    ports:
-      # STAGE 1 ONLY. Remove once NPM points at backend:8000 by name.
-      - "555:8000"
+      - tcg-internal
+      - proxy
     depends_on:
       db:
         condition: service_healthy
@@ -80,10 +59,7 @@ services:
     environment:
       TZ: Europe/Paris
     networks:
-      - proxy           # NPM only. No database access, by construction.
-    ports:
-      # STAGE 1 ONLY. Remove once NPM points at frontend:80 by name.
-      - "444:80"
+      - proxy
 
 networks:
   proxy: