feat(P01): TASK-01-01 docker-compose Postgres service + praxis-net

Add postgres:16-slim service with pgdata/pgbackups volumes, pg_isready
healthcheck, praxis-net bridge network (no published ports — D-040).
The praxis service now depends_on postgres healthy and joins praxis-net.
All existing v0.2 env vars + volumes preserved; v0.4 operator env vars
wired through (PRAXIS_PG_DSN, PRAXIS_COOKIE_SECRET, PRAXIS_COOKIE_SECURE).

---ci---
project: praxis
phase: 1
milestone: v0.4
status: execute
persona: lead-developer
task: 01-01
requirements:
  covered: [REQ-MT-01, REQ-NFR-MT-01]
---/ci---

docker-compose.yml

@@ -1,6 +1,6 @@
-# Praxis v0.2 — Docker Compose service definition
-# Runs the praxis server inside a Docker container (inside an LXC CT).
-# Per RESEARCH.md Q4/Q8 / ARCHITECTURE.md §v0.2 Deployment Architecture.
+# Praxis — Docker Compose service definition (v0.2 + v0.4 Postgres).
+# Runs the praxis server + a Postgres 16 service inside a Docker-in-LXC CT.
+# Per ARCHITECTURE.md §v0.2 Deployment + §v0.4 Operator-Tier Architecture.
 
 services:
   praxis:
@@ -34,6 +34,13 @@ services:
       DEEPGRAM_REGION: "${DEEPGRAM_REGION:-na}"
       # Cartesia (D-014)
       CARTESIA_VOICE_ID: "${CARTESIA_VOICE_ID:-a3536a36-1d18-4efb-a95a-7c44b7b5e384}"
+      # v0.4 operator tier — Postgres DSN (D-050). Empty → graceful no-pool mode.
+      PRAXIS_PG_DSN: "${PRAXIS_PG_DSN:-}"
+      # v0.4 auth (D-041, D-056). Empty → server generates ephemeral secret (dev only).
+      PRAXIS_COOKIE_SECRET: "${PRAXIS_COOKIE_SECRET:-}"
+      PRAXIS_COOKIE_SECURE: "${PRAXIS_COOKIE_SECURE:-true}"
+      PRAXIS_VC_ISSUER_KEY: "${PRAXIS_VC_ISSUER_KEY:-}"
+      PRAXIS_ISSUER_URL: "${PRAXIS_ISSUER_URL:-https://praxis.example/issuers/v0.4}"
     env_file:
       # /etc/praxis/server.env is written by install-service.sh with
       # secrets injected via lxc.environment (G-101 fix: GITEA_TOKEN baked
@@ -43,7 +50,45 @@ services:
       # `docker compose up` in production (so secrets are present at runtime).
       - path: /etc/praxis/server.env
         required: false
+    depends_on:
+      postgres:
+        condition: service_healthy
+    networks:
+      - praxis-net
+
+  postgres:
+    image: postgres:16-slim
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: praxis
+      POSTGRES_PASSWORD: "${PRAXIS_PG_PASSWORD:-}"
+      POSTGRES_DB: praxis
+      PGDATA: /var/lib/postgresql/data/pgdata
+    env_file:
+      - path: /etc/praxis/server.env
+        required: false
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+      - pgbackups:/backups
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U praxis -d praxis"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - praxis-net
+    # No `ports:` — Postgres is NOT exposed to the LXC host bridge (D-040).
+    # The praxis service reaches it via the praxis-net bridge using the
+    # service-DNS name `postgres`.
 
 volumes:
   praxis-data:
     driver: local
+  pgdata:
+    driver: local
+  pgbackups:
+    driver: local
+
+networks:
+  praxis-net:
+    driver: bridge