fix(ci): use db service hostname instead of localhost for Postgres

self-hosted runner is pinned to homelab_proxy network (needed to resolve the gitea host for checkout), so job+service containers are separate network members, not sharing a netns like GitHub-hosted runners service containers do -- localhost inside the job container never reached the db service. Also drops the now-unneeded host port publish (avoids repeating the port-already-allocated failure an earlier orphaned run left behind).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

.gitea/workflows/ci.yml

@@ -15,8 +15,11 @@ jobs:
           POSTGRES_USER: asset_license_mgmt
           POSTGRES_PASSWORD: change-me-local-dev
           POSTGRES_DB: asset_license_mgmt
-        ports:
+        # No `ports:` publish to the host -- reached via the `db` hostname
-          - 5432:5432
+        # over homelab_proxy instead (see DATABASE_URL comment below), and
+        # skipping the host publish avoids a repeat of the "port already
+        # allocated" failure an earlier orphaned run's leftover container
+        # caused.
         options: >-
           --health-cmd pg_isready
           --health-interval 5s
@@ -24,7 +27,13 @@ jobs:
           --health-retries 10
 
     env:
-      DATABASE_URL: postgres://asset_license_mgmt:change-me-local-dev@localhost:5432/asset_license_mgmt
+      # Hostname is the service key ("db"), NOT localhost -- the self-hosted
+      # runner is pinned to the homelab_proxy Docker network (so it can
+      # resolve the `gitea` host for checkout), which means job and service
+      # containers are separate network members rather than sharing a
+      # network namespace the way GitHub-hosted runners' service containers
+      # do. localhost inside the job container does not reach the service.
+      DATABASE_URL: postgres://asset_license_mgmt:change-me-local-dev@db:5432/asset_license_mgmt
       AUTH_SECRET: ci-only-dummy-secret-not-used-in-prod
       AUTH_TRUST_HOST: "true"