Correct production runtime contract

deploy/vps/README.md

@@ -26,7 +26,6 @@ paths before the first start:
   compose.yml
   config/authelia/configuration.yml
   config/authelia/users_database.yml
-  data/app/
   data/authelia/
   data/postgres/
   secrets/jwt_secret
@@ -38,6 +37,10 @@ The Nginx files remain examples until the domain, Cloudflare origin certificate,
 trusted client-address configuration, and private upstream tests are complete.
 Do not enable the virtual host merely because the containers start successfully.
 
+WeatherTool application scratch files are intentionally ephemeral in a
+non-executable in-memory `/app/data` filesystem. PostgreSQL is the durable
+application data store; Authelia and PostgreSQL state use dedicated bind paths.
+
 ## Release image
 
 Build the exact committed revision on Rocky:

deploy/vps/compose.yml

@@ -27,18 +27,18 @@ services:
       postgres:
         condition: service_healthy
     environment:
-      DB_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB}
+      POSTGRES_DB: ${POSTGRES_DB}
-      DB_USER: ${POSTGRES_USER}
+      POSTGRES_USER: ${POSTGRES_USER}
-      DB_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_HOST: postgres
       ENABLE_SCHEDULED_JOBS: "false"
       DEBUG: "false"
     ports:
       - "127.0.0.1:${WEATHERTOOL_PORT:-8002}:8080"
-    volumes:
-      - ./data/app:/app/data
     read_only: true
     tmpfs:
       - /tmp:size=64m,mode=1777
+      - /app/data:size=256m,mode=0770,uid=100,gid=101
     networks:
       - backend
     security_opt:

docs/VPS_STAGING_PLAN.md

@@ -90,6 +90,8 @@ WeatherTool will use:
 - a private application network;
 - its own PostgreSQL service and persistent storage;
 - its own Authelia configuration and storage;
+- an ephemeral writable application scratch filesystem while the remaining
+  application container filesystem stays read-only;
 - a loopback-only application binding, with the final port chosen after the
   VPS inventory; and
 - no shared Docker volumes, database, or application network with HOP or any