feat(db): add bizgaze-postgres service to compose (engine cutover infra)

Adds a dedicated Postgres 16 service (container bizgaze-postgres, own named volume
bizgaze_pg_data, healthcheck) on the shared NPM network. The app depends_on it
healthy. Inert until DB_BACKEND=pg is set in .env — default stays SQLite, so this
deploy changes nothing functionally; it just makes the engine available. Documented
POSTGRES_PASSWORD / DATABASE_URL / DB_BACKEND in .env.example.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -29,3 +29,10 @@ TURN_CREDENTIAL=
 # LIVEKIT_URL=wss://livekit.bizgaze.com
 # LIVEKIT_API_KEY=
 # LIVEKIT_API_SECRET=
+
+# Optional: PostgreSQL data store. Leave unset to use the built-in SQLite file (DB_PATH). To move to
+# Postgres: set POSTGRES_PASSWORD (used by the bizgaze-postgres container AND the URL below), then set
+# DATABASE_URL + DB_BACKEND=pg after running db/migrate-sqlite-to-pg.js. See db/schema.pg.sql.
+# POSTGRES_PASSWORD=
+# DATABASE_URL=postgres://bizgaze:PASSWORD@bizgaze-postgres:5432/bizgaze
+# DB_BACKEND=pg

docker-compose.yml

@@ -34,6 +34,34 @@ services:
       - bizgaze_support_data:/data   # persists data.db across rebuilds
     networks:
       - npm
+    # Wait for Postgres to be healthy before starting. Only matters when DB_BACKEND=pg (else the app uses
+    # the local SQLite file and ignores pg), but it's harmless on SQLite — pg comes up in a second or two.
+    depends_on:
+      bizgazepg:
+        condition: service_healthy
+
+  # PostgreSQL — the app's data store when DB_BACKEND=pg (default is the local SQLite file). Distinct
+  # service/container name so it never collides with the other postgres containers on the shared NPM
+  # network; the app reaches it as `bizgaze-postgres`. Data on its own named volume.
+  bizgazepg:
+    image: postgres:16
+    container_name: bizgaze-postgres
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=bizgaze
+      - POSTGRES_DB=bizgaze
+      # Password comes from the same .env as the app (compose interpolates ${...} from the .env in this dir).
+      # NOTE: Postgres only applies POSTGRES_PASSWORD on FIRST init of an empty data volume.
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-bizgaze_local}
+    volumes:
+      - bizgaze_pg_data:/var/lib/postgresql/data
+    networks:
+      - npm
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U bizgaze -d bizgaze"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
 
   # LiveKit SFU — meeting media server. Optional: only started/used when the app's .env has
   # LIVEKIT_URL/API_KEY/API_SECRET set (otherwise meetings use the built-in P2P mesh). NPM proxies
@@ -68,3 +96,4 @@ networks:
 
 volumes:
   bizgaze_support_data:
+  bizgaze_pg_data: