feat: add initial Docker Compose infrastructure

docs/security-notes.md

@@ -115,12 +115,15 @@ Expected secret configuration:
 
 Use environment variables, Docker secrets, or deployment-managed secret injection. Documentation and example configuration should use placeholders only.
 
+For the Docker Compose setup, copy `.env.example` to `.env` and replace placeholder values outside version control. The repository ignores `.env` and `.env.*` files except `.env.example`.
+
 ## Deployment Security
 
 Deployment should follow least privilege:
 
 - expose only nginx publicly;
 - keep backend and database on an internal Docker network;
+- do not publish backend, frontend, or PostgreSQL ports to the host in production;
 - avoid privileged containers;
 - use explicit image tags rather than `latest`;
 - persist PostgreSQL data in a named volume;