deploy: harden compose harness

docker-compose.yml

@@ -36,7 +36,7 @@ services:
       - ./migrations:/migrations:ro
     command:
       - -path=/migrations
-      - -database=postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-hermes_market}?sslmode=disable
+      - -database=postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set, see .env.example}@postgres:5432/${POSTGRES_DB:-hermes_market}?sslmode=disable
       - up
     restart: "no"
 
@@ -51,12 +51,12 @@ services:
       migrate:
         condition: service_completed_successfully
     ports:
-      - "${APP_PORT:-8080}:8080"
+      - "${APP_HOST_PORT:-8080}:8080"
     environment:
       CONFIG_PATH: /app/config/config.yml
       APP_ENV: ${APP_ENV:-production}
-      APP_PORT: ${APP_PORT:-8080}
-      POSTGRES_DSN: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-hermes_market}?sslmode=disable
+      APP_PORT: "8080"
+      POSTGRES_DSN: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set, see .env.example}@postgres:5432/${POSTGRES_DB:-hermes_market}?sslmode=disable
       BINANCE_BASE_URL: ${BINANCE_BASE_URL:-https://fapi.binance.com}
       # 透传代理：国内直连 fapi.binance.com 不稳，详见 AGENTS.md §7.5
       HTTP_PROXY: ${HTTP_PROXY:-}