feat: persist the database volume across restart/recreate (E00-S02-T04)

Mount the named `db-data` volume at PostgreSQL's data directory
(/var/lib/postgresql/data) on the db service and declare it in the
top-level volumes map, so the database survives `docker compose
restart` and `docker compose down` + `up -d` (recreate). Reset with
`docker compose down -v` per the issue rollback note. Header comments
in compose.yaml and the server Dockerfile updated: T04 is no longer out
of scope; T05/T06 remain.

apps/server/Dockerfile

@@ -8,8 +8,9 @@
 # server answering `GET /health` with `{"status":"ok"}` (HTTP 200) on port
 # 3000, so the app container stays up and the health endpoint succeeds. The
 # Fastify 5 application shell (and the real HTTP API) lands in a later story;
-# volume persistence (T04), non-root/read-only hardening (T05) and multi-arch
-# targets remain later E00-S02 tasks — all out of scope here.
+# DB volume persistence (T04) is a Compose-level concern (see compose.yaml —
+# this image is unchanged), while non-root/read-only hardening (T05/T06) and
+# multi-arch targets remain later E00-S02 tasks — all out of scope here.
 #
 # Image base: node:24.19.0-bookworm-slim (glibc Debian) per Technology-Stack
 # §5.4 — argon2 is a native dependency and musl/Alpine causes native-module