fix: separate DB_PASSWORD from DATABASE_URL to handle special chars

Coolify overrides container_name, so the DB service is only reachable
via its compose service name ("db"), not "worldcup_db". Also, passwords
containing URL-special characters (#, ], =) break postgres URL parsing
because the driver uses new URL() internally.

- docker-compose.yml: DATABASE_URL now uses "db" hostname with no
  embedded password; DB_PASSWORD is passed as a separate env var
- lib/db/index.ts: when DB_PASSWORD env var is set it is passed as a
  postgres driver option, bypassing URL parsing entirely
- .env.example: documents production vs local dev env var usage;
  removes DATABASE_URL from the Coolify section (not needed there)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -1,8 +1,16 @@
-# Database
+# ── Production (Coolify) ────────────────────────────────────────────────────
+# DB_PASSWORD is passed separately so special characters never need URL-encoding.
+# DATABASE_URL is constructed inside docker-compose.yml and does NOT need to be
+# set in Coolify — only DB_PASSWORD is required.
 DB_PASSWORD=changeme
-DATABASE_URL=postgres://wc:changeme@worldcup_db:5432/worldcup
 
 # Traefik (set TRAEFIK_ENABLED=true when deploying behind Traefik)
 TRAEFIK_ENABLED=false
 TRAEFIK_HOST=worldcup.example.com
 NETWORK_NAME=traefik-network
+
+# ── Local development ────────────────────────────────────────────────────────
+# Set DATABASE_URL when running pnpm dev or pnpm sync on the host directly.
+# The password can be plain-text here since it goes through the postgres driver,
+# not URL parsing, when DB_PASSWORD is unset.
+# DATABASE_URL=postgres://wc:wc@localhost:5432/worldcup