fix(docker): remove host port bindings, add idempotent role passwords, Kong app route

Dokploy deployment fixes:
- Remove all host port bindings (Kong 8000/8443/3000, Studio 54323, Inbucket 54324,
  DB 5432) — Traefik handles external routing in Dokploy, host ports conflict
  with other services on the shared server
- Add idempotent ALTER ROLE password commands to db-migrate service — ensures
  role passwords are set even when DB volume persists across deployments
  (docker-entrypoint-initdb.d only runs on empty data dirs)
- Add catch-all app route to Kong config — proxies / to localhost:3000
  (Next.js app via network_mode: service:supabase-kong)

docker/kong.yml

@@ -85,3 +85,14 @@ services:
           hide_groups_header: true
           allow:
             - admin
+
+  # Next.js App (catch-all — must be last so API routes take priority)
+  - name: app
+    url: http://localhost:3000/
+    routes:
+      - name: app-routes
+        strip_path: false
+        paths:
+          - /
+    plugins:
+      - name: cors