feat: consolidate deployment compose into root under --profile deploy (COW-976)

[lgahdl]

Summary

Consolidate deployment/docker-compose.yml into the root docker-compose.yml as a --profile deploy profile, eliminating the duplicate file. The default docker compose up dev-database behavior is unchanged.

Changes

• Added postgres-deploy and ponder services to root docker-compose.yml under profiles: [deploy]
• Adjusted volume path for start-db.sh from ./static/ to ./deployment/static/ (context is now repo root)
• Deleted deployment/docker-compose.yml
• Updated deployment/manage.sh to reference ../docker-compose.yml with --profile deploy
• Updated references to the old file path in docs/deployment.md

How to Test

1. Run docker compose --profile deploy up and verify the deploy stack starts (postgres + ponder)
2. Run docker compose up (no profile) and verify only the dev postgres starts as before

Checklist

• Tests pass locally
• Linting passes
• Documentation updated (if needed)
• Breaking changes documented (if any)

Breaking Changes

None — docker compose --profile deploy up replaces the old docker compose -f deployment/docker-compose.yml up.

Related Issues

COW-976

[linear-code]

COW-976

[yvesfracari]

why we can't use the same db container config for prod and dev?

[lgahdl]

Good point — addressed in the latest commit. The two services are now unified into a single postgres service that uses ${POSTGRES_USER:-postgres}-style defaults, so docker compose up works for dev without a .env file, and production overrides the credentials via env vars.

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}