feat: pin the database container to PostgreSQL 18.6 (E00-S03-T01)

- compose.yaml: db.image pinned to postgres:18.6-bookworm (exact 18.6 minor,
  same bookworm flavor, no Alpine drift) so the database container is
  reproducible and exposes the expected PostgreSQL version; document the
  rollback (revert image to postgres:18-bookworm)
- .gitea/workflows/ci.yml: new compose-config job runs
  tests/compose-config.test.mjs on every PR so the pinned-version criterion
  gates merges (docker-gated real-stack probes skip cleanly without a daemon)

compose.yaml

@@ -1,4 +1,4 @@
-# EPPP Docker Compose baseline — [E00-S02-T01..T08]
+# EPPP Docker Compose baseline — [E00-S02-T01..T08] + [E00-S03-T01]
 #
 # `docker compose up -d` starts both the database (PostgreSQL) and the
 # application (@personal-blog/server). Rollback: `docker compose down`.
@@ -53,9 +53,12 @@
 
 services:
   db:
-    # PostgreSQL 18 on Debian bookworm — the documented runtime target
-    # (Technology-Stack §5.2/§5.4/§6.2, golden tuple §7; no Alpine drift).
-    image: postgres:18-bookworm
+    # PostgreSQL 18.6 on Debian bookworm — the documented runtime target
+    # (Technology-Stack §5.2/§5.4/§6.2, golden tuple §7; no Alpine drift),
+    # pinned to the exact 18.6 minor (E00-S03-T01) so the database container
+    # is reproducible and exposes the expected PostgreSQL version. Rollback:
+    # revert `image` to `postgres:18-bookworm`.
+    image: postgres:18.6-bookworm
     environment:
       POSTGRES_DB: ${POSTGRES_DB:-eppp}
       POSTGRES_USER: ${POSTGRES_USER:-eppp}