cli: docker-compose template publishes Postgres on 0.0.0.0:5432 with postgres/postgres while the app runs in production mode #444

The smpy new docker template (0.0.35) generates a docker-compose.yml whose postgres service:

• uses the hard-coded password postgres (also baked into the app's SM_DATABASE_URL), and
• publishes 5432:5432 on all host interfaces,

while the app service is explicitly SM_ENVIRONMENT: production. Anyone who runs make docker-up on a server exposes a superuser-password Postgres to the network. It also collides with the shared dev-services Postgres on 5432.

Suggested template:

• drop the ports: on postgres (the app reaches it over the compose network), or bind 127.0.0.1: if host access is wanted;
• POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD} and interpolate the same variable into SM_DATABASE_URL;
• snake_case DB name (see cli: scaffold hygiene — 'sm' CLI name in templates, uv.lock gitignored, kebab-case Postgres DB name #443).