Source the local PostgreSQL password from .env instead of hardcoding it

[devin-ai-integration]

Summary

Remediates two SonarCloud secrets:S6698 findings (issue keys AZ6OP-dvRoUIIbwnU9ka in docker-compose.yml, AZ6OP-ORRoUIIbwnU9du in services/document-service/app/config.py): the shared Postgres dev password was hardcoded in the compose stack and in the document-service default database_url.

Root-cause fix: the password now lives in a single, gitignored .env consumed by compose and the Makefile.

• docker-compose.infra.yml (postgres) and every service block in docker-compose.yml: otterworks_dev → ${POSTGRES_PASSWORD:?...} (required; compose fails fast with a pointer to .env.example if unset).
• New committed .env.example with an empty POSTGRES_PASSWORD=; new make .env target generates .env with openssl rand -hex 16 on first use. up/infra-up/build/dev-backend depend on it, so make up still works out of the box.
• Makefile -include .env + export POSTGRES_PASSWORD / DB_PASSWORD ?= $(POSTGRES_PASSWORD) so make seed, testdata-* and scripts/seed.py / testdata/harness/validate.py pick the same password (their otterworks_dev fallbacks removed).
• dast-scan.yml runs make .env before bringing the stack up (no change to what the gate checks).
• Settings.database_url default drops the credential: postgresql+asyncpg://otterworks@localhost:5432/otterworks; the real URL comes from DOC_SVC_DATABASE_URL as compose already sets it. tests/test_config.py asserts the default carries no password (fails on the old code) and that the env override is honored.

Not touched: services/document-service/alembic.ini and other services' own config defaults (separate findings), docker-compose.procs.yml / docker-compose.insurance.yml.

Verified: poetry run pytest tests/test_config.py (2 passed), ruff check, docker compose ... config passes with .env and fails with the expected message without it.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/6d478d16034b42838ca75e162a476901
Open in Devin Desktop: https://partner-workshops.devinenterprise.com/desktop/session/6d478d16034b42838ca75e162a476901?variant=devin
Requested by: @mbatchelor81

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring