chore(deploy): non-root image, reproducible builds, private database

- Dockerfile: Go 1.26, npm ci, go mod verify, non-root user, alpine 3.22.
- Compose: Postgres no longer published on the host, password and new
  security settings read from .env, GOMEMLIMIT.
- README: document new environment variables and reading shortcuts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -26,14 +26,16 @@
 Thumbs.db
 task.md
 
-# Go
+# Go (go.sum is committed for reproducible, verified builds)
 vendor/
-go.sum
 
 # Node
 node_modules/
 npm-debug.log
 yarn-error.log
 
+# Tooling
+.playwright-mcp/
+
 # FlowReader Specific
 /_bmad-output/tmp/