fix: separate DB_PASSWORD from DATABASE_URL to handle special chars

Coolify overrides container_name, so the DB service is only reachable
via its compose service name ("db"), not "worldcup_db". Also, passwords
containing URL-special characters (#, ], =) break postgres URL parsing
because the driver uses new URL() internally.

- docker-compose.yml: DATABASE_URL now uses "db" hostname with no
  embedded password; DB_PASSWORD is passed as a separate env var
- lib/db/index.ts: when DB_PASSWORD env var is set it is passed as a
  postgres driver option, bypassing URL parsing entirely
- .env.example: documents production vs local dev env var usage;
  removes DATABASE_URL from the Coolify section (not needed there)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/db/index.ts

@@ -4,7 +4,12 @@ import * as schema from './schema'
 
 const connectionString = process.env.DATABASE_URL ?? 'postgres://wc:wc@localhost:5432/worldcup'
 
-const client = postgres(connectionString, { max: 10 })
+// DB_PASSWORD is passed separately to avoid URL-encoding issues with special chars
+// (e.g. #, ], = in passwords break URL parsing). Falls back to password in DATABASE_URL for local dev.
+const client = postgres(connectionString, {
+  max: 10,
+  ...(process.env.DB_PASSWORD ? { password: process.env.DB_PASSWORD } : {}),
+})
 export const db = drizzle(client, { schema })
 
 export * from './schema'