Move Docker Passwords Out of Environment Variables with Compose Secrets

Move one Docker Compose password into a file-backed secret, limit service access, test allowed and denied paths, and keep a safe rollback.