feat(compose): internal db network and api healthcheck

Add the internal-only legacyhub_db network (same name the teamhub
federation overlay already uses) plus an edge network to the base
compose. Dev keeps host-published ports via edge; the prod overlay
pins data services to legacyhub_db only, closing the module-contract
gap (DB/broker on internal networks). Add a curl liveness healthcheck
for the api container against /api/v1/health.

Verified: docker compose config for dev, prod and prod+teamhub
stacks; per-service network/port/healthcheck matrix inspected via
config --format json.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -10,6 +10,7 @@
 #
 # This overlay narrows the dev-friendly defaults:
 #   - removes published ports from data services (only api stays public);
+#   - pins data services to the internal-only docker network (no egress);
 #   - turns on the OpenSearch security plugin and forces an admin password;
 #   - requires CORS_ALLOWED_ORIGINS to be set (no localhost fallback);
 #   - bumps Java + worker concurrency for real workloads;
@@ -17,6 +18,7 @@
 
 services:
   postgres:
+    networks: !override [legacyhub_db]
     ports: !reset []
     environment:
       POSTGRES_DB: ${POSTGRES_DB}
@@ -26,6 +28,7 @@ services:
 
   minio:
     command: server /data
+    networks: !override [legacyhub_db]
     ports: !reset []
     environment:
       MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:?MINIO_ACCESS_KEY must be set}
@@ -33,6 +36,7 @@ services:
     restart: always
 
   opensearch:
+    networks: !override [legacyhub_db]
     ports: !reset []
     environment:
       - discovery.type=single-node
@@ -44,12 +48,14 @@ services:
     restart: always
 
   qdrant:
+    networks: !override [legacyhub_db]
     ports: !reset []
     environment:
       QDRANT__SERVICE__API_KEY: ${QDRANT_API_KEY:?QDRANT_API_KEY must be set}
     restart: always
 
   redis:
+    networks: !override [legacyhub_db]
     ports: !reset []
     restart: always