Automatisiert pg_dump, .env, Compose und Git-Archiv mit Tag-Zuordnung, Retention (5) und Pre-Deploy-Hook nur für Prod.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add rotate-postgres-password.sh with optional app role, document the
procedure, and stop defaulting production POSTGRES_PASSWORD to postgres.
Co-authored-by: Cursor <cursoragent@cursor.com>