Fix pgbouncer scram-sha-256 auth and document Postgres prod env vars

Two real bugs hit during tonight's first production deploy (found and
fixed live on the server, folded back into the tracked config so the
next deploy doesn't hit either wall):

1. pgbouncer defaults to md5 auth; postgres:17-alpine defaults password_encryption
   to scram-sha-256. Every connection failed with "wrong password type"
   until AUTH_TYPE=scram-sha-256 was set explicitly on the pgbouncer service.

2. POSTGRES_USER/PASSWORD/DB were never documented anywhere (not in
   .env.example, despite docker-compose.prod.yml requiring them) --
   added, with a note against `openssl rand -base64` for the password
   specifically: its output can contain /+=, which breaks pgbouncer's
   (and any DATABASE_URL parser's) naive URL parsing. Pointed at
   token_urlsafe instead, matching the other generated secrets.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

docker-compose.prod.yml

@@ -39,6 +39,10 @@ services:
       POOL_MODE: transaction
       MAX_CLIENT_CONN: "1000"
       DEFAULT_POOL_SIZE: "25"
+      # postgres:17-alpine defaults password_encryption to scram-sha-256;
+      # pgbouncer defaults auth_type to md5, which then fails every
+      # connection with "wrong password type" against a scram-only server.
+      AUTH_TYPE: scram-sha-256
     depends_on:
       postgres:
         condition: service_healthy