chore: dev/prod Docker compose separation with safety docs

- Add docker-compose.override.yml exposing db/redis ports for local dev
- Remove override from .gitignore so all devs get port mappings
- Use explicit -f in deploy.sh to skip override in production
- Document production safety rule: always use -f on the server

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.override.yml

@@ -0,0 +1,9 @@
+# docker-compose.override.yml — auto-loaded in dev, skipped in prod via explicit -f
+# Exposes database and cache ports to localhost for local development.
+services:
+  db:
+    ports:
+      - "127.0.0.1:5432:5432"
+  redis:
+    ports:
+      - "127.0.0.1:6379:6379"