chore: dev/prod Docker compose separation with safety docs

- Add docker-compose.override.yml exposing db/redis ports for local dev
- Remove override from .gitignore so all devs get port mappings
- Use explicit -f in deploy.sh to skip override in production
- Document production safety rule: always use -f on the server

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -16,7 +16,7 @@
 
 set -euo pipefail
 
-COMPOSE="docker compose --profile full"
+COMPOSE="docker compose -f docker-compose.yml --profile full"
 HEALTH_URL="http://localhost:8001/health"
 HEALTH_RETRIES=12
 HEALTH_INTERVAL=5