Isolate CI/deploy tests from host/prod DATABASE_URL.

Compose was interpolating ${DATABASE_URL} from the Act runner, so containerized tests could hit shared Postgres. Use COMPOSE_DATABASE_URL, an ephemeral compose project with down -v, and clear DB env in unit-test workflows.

.gitea/workflows/deploy.yml

@@ -20,15 +20,27 @@ jobs:
       - name: Build Docker image
         run: docker compose build
 
+      # Ephemeral local Postgres only — never inherit host DATABASE_URL (prod).
       - name: Run containerized tests
         run: |
-          docker compose up -d db
-          docker compose run --rm --entrypoint "" \
+          set -euo pipefail
+          # Drop host/prod DB secrets so compose cannot interpolate them.
+          unset DATABASE_URL DB_HOST DB_NAME DB_USER DB_PASSWORD DB_PORT \
+            COMPOSE_DATABASE_URL DJANGO_ENV DJANGO_SECRET_KEY DJANGO_DEBUG \
+            DJANGO_ALLOWED_HOSTS || true
+
+          PROJECT="scha-ci-${{ gitea.event.workflow_run.head_sha }}"
+          cleanup() { docker compose -p "$PROJECT" down -v --remove-orphans || true; }
+          trap cleanup EXIT
+
+          docker compose -p "$PROJECT" up -d --wait db
+          docker compose -p "$PROJECT" run --rm --no-deps --entrypoint "" \
             -e DJANGO_ENV=dev \
             -e DJANGO_SECRET_KEY=test-secret-key \
+            -e DJANGO_DEBUG=true \
+            -e DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,testserver \
             -e DATABASE_URL=postgres://scha:scha@db:5432/scha \
             web uv run python manage.py test
-          docker compose down
 
   deploy:
     if: gitea.event.workflow_run.conclusion == 'success' && gitea.event.workflow_run.event == 'push'