fix(llm): postgres port publish needs a non-internal net — add hostpub bridge (refs #565)

compose.yml

@@ -34,6 +34,17 @@ networks:
     ipam:
       config:
         - subnet: 192.168.9.0/24
+  hostpub:
+    # Docker cannot publish ports from a container whose networks are all
+    # internal. This non-internal bridge exists solely to carry loopback
+    # port publishes (e.g. postgres 127.0.0.1:5432 for host-side llm batch
+    # runs); no service-to-service traffic should use it.
+    name: hostpub
+    driver: bridge
+    internal: false
+    ipam:
+      config:
+        - subnet: 192.168.10.0/24
 
 services:
   coredns:
@@ -130,6 +141,7 @@ services:
     container_name: postgres
     networks:
       - storage
+      - hostpub
     ports:
       # Loopback-only: host-side llm batch runs (indexer/tagger) need
       # pgvector; everything else still uses the storage net.