Isolate CI/deploy tests from host/prod DATABASE_URL.

Compose was interpolating ${DATABASE_URL} from the Act runner, so containerized tests could hit shared Postgres. Use COMPOSE_DATABASE_URL, an ephemeral compose project with down -v, and clear DB env in unit-test workflows.

README.md

@@ -27,7 +27,8 @@ Without `DATABASE_URL` / `DB_HOST`, settings fall back to SQLite (`db.sqlite3`).
 docker compose up --build
 ```
 
-App: http://localhost:8000 — Postgres via `DATABASE_URL=postgres://scha:scha@db:5432/scha`.
+App: http://localhost:8000 — Postgres via bundled `db` (`postgres://scha:scha@db:5432/scha`).
+Compose does **not** read host `DATABASE_URL` (avoids CI/prod leaks); override with `COMPOSE_DATABASE_URL` if needed.
 
 ## Environment variables
 
@@ -69,7 +70,7 @@ Validate with:
 |----------|---------|--------|
 | `unittests.yml` | push + PR → `master` | `uv sync` + `manage.py test` |
 | `ci.yml` | PR → `master` | same unit tests |
-| `deploy.yml` | after Unit Tests succeeds on `master` **push** | docker build/test → `deploy.sh` |
+| `deploy.yml` | after Unit Tests succeeds on `master` **push** | docker build + tests on **ephemeral compose Postgres** → `deploy.sh` |
 
 Deploy never runs on PRs.