feat(docker): split postgres into main + backup services

Phase 0 (PLANS.md section 2) calls for two Postgres instances:
- postgres-main on host port 5432 — the primary read/write target
- postgres-backup on host port 5433 — used by MultiPoolService in
  Phase 3 for read-only fallback and HA failover

The legacy single-postgres service and its postgres_data volume are
renamed so existing local volumes do not collide with the new layout.
Operators with a pre-existing postgres_data volume from earlier work
can rename it manually with `docker volume rename` before pulling.

Depends on feat/env-fix-port-credentials for the DB_READ_* env block
that the backup service consumes. app-dev / app-staging / app-prod
profiles' depends_on entries are updated to point at postgres-main.
docker compose config validates clean.
Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.yml

@@ -3,9 +3,9 @@
 # Run independently: docker compose up -d
 # ─────────────────────────────────────────────
 services:
-  postgres:
+  postgres-main:
     image: postgres:17-alpine
-    container_name: sso-postgres
+    container_name: sso-postgres-main
     restart: unless-stopped
     ports:
       - '${POSTGRES_PORT:-5432}:5432'
@@ -14,7 +14,7 @@ services:
       POSTGRES_PASSWORD: ${DB_PASSWORD:-postgres}
       POSTGRES_DB: ${DB_NAME:-sso}
     volumes:
-      - postgres_data:/var/lib/postgresql/data
+      - postgres_main_data:/var/lib/postgresql/data
     networks:
       - sso-network
     healthcheck:
@@ -23,6 +23,26 @@ services:
       timeout: 5s
       retries: 5
 
+  postgres-backup:
+    image: postgres:17-alpine
+    container_name: sso-postgres-backup
+    restart: unless-stopped
+    ports:
+      - '${POSTGRES_PORT_BACKUP:-5433}:5432'
+    environment:
+      POSTGRES_USER: ${DB_READ_USER:-${DB_USER:-postgres}}
+      POSTGRES_PASSWORD: ${DB_READ_PASSWORD:-${DB_PASSWORD:-postgres}}
+      POSTGRES_DB: ${DB_READ_NAME:-sso_backup}
+    volumes:
+      - postgres_backup_data:/var/lib/postgresql/data
+    networks:
+      - sso-network
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U ${DB_READ_USER:-${DB_USER:-postgres}}']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
   mongo:
     image: mongo:7
     container_name: sso-mongo
@@ -109,7 +129,7 @@ services:
     networks:
       - sso-network
     depends_on:
-      postgres:
+      postgres-main:
         condition: service_healthy
       mongo:
         condition: service_healthy
@@ -143,7 +163,7 @@ services:
     networks:
       - sso-network
     depends_on:
-      postgres:
+      postgres-main:
         condition: service_healthy
       mongo:
         condition: service_healthy
@@ -177,7 +197,7 @@ services:
     networks:
       - sso-network
     depends_on:
-      postgres:
+      postgres-main:
         condition: service_healthy
       mongo:
         condition: service_healthy
@@ -197,7 +217,8 @@ networks:
     driver: bridge
 
 volumes:
-  postgres_data:
+  postgres_main_data:
+  postgres_backup_data:
   mongo_data:
   redis_data:
   minio_data: