fix(deploy): explicit backend network for steward↔db traffic

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

compose.deploy.yml

@@ -16,6 +16,8 @@ services:
     pull_policy: always
     ports:
       - "5000:5000"
+    networks:
+      - backend
     volumes:
       # /data holds the auto-generated secret key, third-party plugins, and the
       # Ansible playbook cache — all of which must survive image updates. No
@@ -33,13 +35,15 @@ services:
 
   db:
     image: postgres:16-alpine
+    networks:
+      - backend
     environment:
       POSTGRES_USER: steward
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-steward}
       POSTGRES_DB: steward
     volumes:
       - pgdata:/var/lib/postgresql/data
-    # No host port published — Postgres is reachable only on the compose network.
+    # No host port published — db is reachable only on the backend network.
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U steward"]
       interval: 5s
@@ -47,6 +51,9 @@ services:
       retries: 5
     restart: unless-stopped
 
+networks:
+  backend:
+
 volumes:
   pgdata:
   app_data: