Dokploy deployment fixes: - Remove all host port bindings (Kong 8000/8443/3000, Studio 54323, Inbucket 54324, DB 5432) — Traefik handles external routing in Dokploy, host ports conflict with other services on the shared server - Add idempotent ALTER ROLE password commands to db-migrate service — ensures role passwords are set even when DB volume persists across deployments (docker-entrypoint-initdb.d only runs on empty data dirs) - Add catch-all app route to Kong config — proxies / to localhost:3000 (Next.js app via network_mode: service:supabase-kong)