Clean up production Compose and deployment guidance after PR batch lands

[dkijania]

Context

Luis approved #196 and #197, but left a set of deployment cleanup notes that are better handled after the current PR batch merges rather than by reopening the docs PRs.

Some of this overlaps with the #186 TRUST_PROXY docs blocker, which #215 already tracks as a release prerequisite. This issue is for the remaining production Compose/deployment polish.

Follow-up work

• Add stop_grace_period: 30s to deploy/docker-compose.prod.yml. Docker Compose defaults to 10s, while P1: Graceful shutdown — drain, flush traces, uncaught handlers (#170) #188's default SHUTDOWN_TIMEOUT_MS is 20000, so a Compose redeploy can still SIGKILL mid-drain.
• Correct any remaining TRUST_PROXY=0 / unset wording in deployment docs after P0: Add per-IP request rate limiting (#166) #185 lands. Unset disables rate limiting; 0 is an explicit direct-exposure setting.
• Make the GCP external ALB case explicit in copied deployment comments: bare GCP external ALB needs TRUST_PROXY=2, plus one per extra hop.
• Pin or document PG_MAX_CONNECTIONS in the manifest/Compose examples. With the HPA max of 6 replicas, the default pool of 10 plus one readiness client each is already 66 connections against a stock max_connections = 100.
• Add a Compose warning for ENABLE_METRICS=true with published 8080:8080: /metrics becomes publicly reachable on a 0.0.0.0 bound host unless the operator restricts access.
• Keep termination grace wording aligned across runbook and manifests: 15s preStop, 10s app drain, terminationGracePeriodSeconds: 45.

Acceptance criteria

• Production Compose grants enough stop grace for P1: Graceful shutdown — drain, flush traces, uncaught handlers (#170) #188's shutdown timeout.
• Deployment comments distinguish unset TRUST_PROXY from explicit TRUST_PROXY=0.
• GCP ALB hop-count guidance is consistent across security docs, runbook, manifests, and Compose docs.
• Connection pool sizing is visible in deployment examples.
• Public /metrics exposure is called out for Compose.

Related

• P0: Add per-IP request rate limiting (#166) #185
• P1: Graceful shutdown — drain, flush traces, uncaught handlers (#170) #188
• P2: Reference deployment manifests — k8s + prod Compose (#179) #196
• P2: Operations runbook — SLOs, capacity, incidents, failover (#180) #197
• v1.0.0 release checklist: ordering prerequisites, breaking-change notes, and post-tag verification #215