Replace hardcoded DB credentials with env vars in docker-compose

Adds .env.example as a template and .gitignore to exclude the actual
.env file, preventing accidental credential commits.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,4 @@
+# Copy to .env and set a strong password before starting
+DB_USER=pamietnik
+DB_NAME=pamietnik
+DB_PASSWORD=change-me-before-production

.gitignore

@@ -0,0 +1 @@
+.env

docker-compose.yml

@@ -2,13 +2,13 @@ services:
   postgres:
     image: postgres:16-alpine
     environment:
-      POSTGRES_USER: pamietnik
-      POSTGRES_PASSWORD: pamietnik
-      POSTGRES_DB: pamietnik
+      POSTGRES_USER: ${DB_USER:-pamietnik}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required}
+      POSTGRES_DB: ${DB_NAME:-pamietnik}
     volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U pamietnik"]
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-pamietnik}"]
       interval: 5s
       timeout: 5s
       retries: 5
@@ -20,7 +20,7 @@ services:
     ports:
       - "9050:8080"
     environment:
-      DATABASE_URL: postgres://pamietnik:pamietnik@postgres:5432/pamietnik?sslmode=disable
+      DATABASE_URL: postgres://${DB_USER:-pamietnik}:${DB_PASSWORD:?DB_PASSWORD is required}@postgres:5432/${DB_NAME:-pamietnik}?sslmode=disable
       LISTEN_ADDR: :8080
     depends_on:
       postgres: