fix: DB password — read from secrets file, bypasses Docker Compose interpolation

- Add secrets/db_password file support to docker-compose.yml (Docker secrets mount)
- config.py reads POSTGRES_PASSWORD_FILE if set, builds DATABASE_URL with proper URL encoding
- Remove inline DATABASE_URL construction from docker-compose.yml (was subject to $VAR interpolation)
- Any password with any characters now works — no escaping needed

Authored by: Jack Levy

.gitignore

@@ -18,4 +18,7 @@ frontend/out/
 # Docker — bind-mount data directories (created on first run)
 postgres/
 redis/
+
+# Secrets — never commit these
+secrets/
 *.log