feat(deploy): drop capabilities on every traffic-facing service

[simonvanlierde]

Recovered from a branch that was deleted after #244 merged only its first commit — this half never reached main.

Only backup and clamav dropped capabilities; api, migrator, docs, app and www ran with Docker's default set. Caddy and uvicorn bind an unprivileged port and need none of it, so the drop is free.

• one x-hardening anchor carrying cap_drop: [ALL], no-new-privileges:true and pids_limit: 512
• backup and clamav collapse onto it, deleting their duplicated blocks
• postgres, redis and cloudflared stay uncovered: they run as their own image users and need a separate look

Behaviour change worth noting: the five newly covered services had no pids_limit before and now inherit 512. Caddy and uvicorn sit far below that, and backup/clamav have run at 512 all along.

Cherry-picked cleanly onto current main; check yaml and the rest of the hooks pass, seven services resolve the anchor, no duplicate keys. Verified on a staging host before the branch was lost: relab-docs serves 200, relab-www and relab-app report healthy with the full flag set.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[simonvanlierde]

Closing: the premise was wrong. api, migrator, docs, app and www already merge x-service-hardening from the base compose.yaml, so they have carried cap_drop: ALL, no-new-privileges:true and pids_limit: 512 all along — docker inspect on the running containers confirms it.

This overlay anchor therefore adds nothing, and duplicates it: Compose concatenates list-valued keys across files, so the second security_opt sits beside the base's identical entry and compose config fails with services.docs.security_opt items at 0 and 1 are equal.

The one service genuinely covered by neither anchor is cloudflared. That is worth a separate look; postgres and redis are on x-stateful-hardening, which omits cap_drop deliberately.