#949 Postgres password is the literal 'postgres'; rotate and stop sharing the superuser across services

EARS: No service shall connect to PostgreSQL with a default or repo-visible password; the superuser shall not be used by api/workers. Found during #945: docker-compose.yml POSTGRES_PASSWORD postgres; any process on highway_network (e.g. tenant app code) can log in as superuser. Interim before pg-nano client certs (#925): random password from /etc/highway/secrets, distinct runtime role (DML only) for api/workers, superuser only for migrations. Verify: old password refused, new path works, workers healthy.