harden(deploy): db internal-only + robust container-loopback frontend verify

- db: drop host :5432 publish (ports !override []) — no LAN exposure, reached
  via compose net (db:5432) + docker exec for the ALTER USER reconcile. Matches
  inspectflow isolation. backend :8081 kept (LAN-only, used by healthcheck).
- deploy verify-frontend: probe container loopback via bundled node instead of
  host :3000 wget. Network-namespace-independent; fixes the transient
  false-failure when polling mid-recreate. <500 = healthy (307->/login).

docker-compose.truenas.yml

@@ -14,6 +14,12 @@
 #     -p cannamanage up -d --build --remove-orphans
 services:
   db:
+    # Internal-only: drop the host :5432 publish inherited from docker-compose.yml.
+    # Postgres must not be exposed to the LAN. The backend reaches it over the
+    # compose network (db:5432) and the deploy's ALTER USER reconcile uses
+    # `docker exec`, so no published host port is needed. (!override [] replaces
+    # the inherited ports list — compose otherwise concatenates lists.)
+    ports: !override []
     # POSTGRES_PASSWORD only takes effect on FIRST volume init; the existing
     # cannamanage_pgdata volume keeps its current role password. The live role
     # password is rotated out-of-band via `ALTER USER` to match ${DB_PASSWORD}.