Reach QA's published ports from the smoke-qa job container via bridge gateway

The runner executes each job in its own container on docker's default bridge
network, so "localhost" never resolves to the docker host - smoke-qa's direct
Postgres connection and Playwright/API HTTP calls need the bridge gateway IP
instead. Bind the db port to that same gateway IP (not 0.0.0.0) so it stays
reachable only from sibling containers, not off-box.

scripts/ci/deploy-qa.sh

@@ -13,6 +13,12 @@ export API_IMAGE ADMIN_IMAGE
 export JWT_SECRET_KEY="${JWT_SECRET_KEY:?JWT_SECRET_KEY env var is required}"
 export QA_ADMIN_PORT="${QA_ADMIN_PORT:-3001}"
 
+# Bind narrowly to docker's bridge gateway IP rather than 0.0.0.0: reachable
+# from the smoke-qa job container (a sibling on the default bridge), but not
+# exposed on the host's public interface.
+export DB_BIND_HOST="$(docker_bridge_gateway)"
+[[ -n "$DB_BIND_HOST" ]] || fail "could not determine docker bridge gateway IP to bind the QA db port"
+
 COMPOSE="docker compose -p miccheck-qa -f deploy/qa/docker-compose.qa.yml"
 
 log "Pulling latest :qa images"