fix: separate DB_PASSWORD from DATABASE_URL to handle special chars

Coolify overrides container_name, so the DB service is only reachable
via its compose service name ("db"), not "worldcup_db". Also, passwords
containing URL-special characters (#, ], =) break postgres URL parsing
because the driver uses new URL() internally.

- docker-compose.yml: DATABASE_URL now uses "db" hostname with no
  embedded password; DB_PASSWORD is passed as a separate env var
- lib/db/index.ts: when DB_PASSWORD env var is set it is passed as a
  postgres driver option, bypassing URL parsing entirely
- .env.example: documents production vs local dev env var usage;
  removes DATABASE_URL from the Coolify section (not needed there)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -2,12 +2,12 @@ services:
   app:
     build: .
     restart: unless-stopped
-    container_name: worldcup
     depends_on:
       db:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgres://wc:${DB_PASSWORD}@worldcup_db:5432/worldcup
+      DATABASE_URL: postgres://wc@db:5432/worldcup
+      DB_PASSWORD: ${DB_PASSWORD}
       NODE_ENV: production
     labels:
       - "traefik.enable=${TRAEFIK_ENABLED:-false}"
@@ -27,7 +27,6 @@ services:
   db:
     image: postgres:16-alpine
     restart: unless-stopped
-    container_name: worldcup_db
     environment:
       POSTGRES_DB: worldcup
       POSTGRES_USER: wc