docs(security): harden production Docker Compose defaults

[ihopenre-eng]

Summary

• keep PostgreSQL and RabbitMQ on the internal Compose network instead of publishing their ports on the host
• require operator-provided credentials for PostgreSQL, RabbitMQ, and the initial Hatchet owner
• reuse those credentials consistently across the documented services
• remove the documented default owner credentials

Rationale

The guide describes this stack as production-ready, so the example should be secure when copied as documented. Internal dependencies do not need host-published ports for inter-service communication, and production credentials should be supplied explicitly by the operator.

This keeps the change scoped to deployment hardening and documentation clarity.

Validation

• git diff --check
• manually reviewed Compose variable interpolation and service references
• docker compose config was not run because Docker is unavailable in the local environment

[vercel]

@ihopenre-eng is attempting to deploy a commit to the Hatchet Team on Vercel.

A member of the Team first needs to authorize it.