Move QA Postgres password out of docker-compose into Gitea secret

Follows the same pattern already used for JWT_SECRET_KEY: interpolated
from a required env var, sourced from a Gitea Actions secret in CI.

deploy/qa/.env.example

@@ -9,4 +9,5 @@ REGISTRY_TOKEN=changeme
 
 # QA environment
 JWT_SECRET_KEY=change-this-to-a-random-32-plus-char-secret
+POSTGRES_PASSWORD=change-this-to-a-random-password
 QA_ADMIN_PORT=3001