PostgreSQL with a persistent volume, a one-off migrate service running
migrate_locked, and the web app, which starts only after migrations
succeeded. The app runs with a read-only filesystem, no capabilities and
a health check. Configuration comes from .env (or ENV_FILE). Checked end
to end: database healthy, migrations applied, both probes OK, login
works.
