Reach QA's published ports from the smoke-qa job container via bridge gateway

The runner executes each job in its own container on docker's default bridge
network, so "localhost" never resolves to the docker host - smoke-qa's direct
Postgres connection and Playwright/API HTTP calls need the bridge gateway IP
instead. Bind the db port to that same gateway IP (not 0.0.0.0) so it stays
reachable only from sibling containers, not off-box.

deploy/qa/docker-compose.qa.yml

@@ -2,9 +2,10 @@ name: miccheck-qa
 
 # Dedicated, network-isolated QA stack. Not connected to the dev compose
 # stack's network - runs entirely on its own bridge network below. The API has
-# no published host port; Postgres is bound to 127.0.0.1 only, so the smoke-qa
-# CI job (running on this same host) can seed/inspect data directly while it
-# stays unreachable off-box.
+# no published host port; Postgres is bound to DB_BIND_HOST (docker's bridge
+# gateway IP, computed by deploy-qa.sh) so the smoke-qa CI job - itself a
+# sibling container on that same default bridge - can seed/inspect data
+# directly, while it stays unreachable off-box (unlike binding to 0.0.0.0).
 services:
 
   db:
@@ -14,7 +15,7 @@ services:
       POSTGRES_USER: miccheck
       POSTGRES_PASSWORD: password
     ports:
-      - "127.0.0.1:55432:5432"
+      - "${DB_BIND_HOST:-127.0.0.1}:55432:5432"
     volumes:
       - miccheck-qa-pgdata:/var/lib/postgresql/data
     networks: