fix(deploy): restrict backend and postgres ports to localhost

Limit direct network exposure on staging by binding backend and Postgres to 127.0.0.1 while keeping frontend public via the reverse proxy.

Made-with: Cursor

docker-compose.yml

@@ -12,7 +12,7 @@ services:
     volumes:
       - postgres_data:/var/lib/postgresql/data
     ports:
-      - "5432:5432"
+      - "127.0.0.1:5432:5432"
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres"]
       interval: 10s
@@ -40,7 +40,7 @@ services:
       postgres:
         condition: service_healthy
     ports:
-      - "5001:5001"
+      - "127.0.0.1:5001:5001"
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://localhost:5001/api/v1/health || exit 1"]
       interval: 30s