Remove PostGIS password from image metadata

deploy/unraid/Dockerfile.all-in-one

@@ -12,9 +12,6 @@ ENV GEOINTEL_ENV=production \
     GEOINTEL_API_PREFIX=/api/v1 \
     GEOINTEL_STORAGE_ROOT=/app/storage \
     STORAGE_ROOT=/app/storage \
-    GEOINTEL_POSTGRES_DB=geointel \
-    GEOINTEL_POSTGRES_USER=geointel \
-    GEOINTEL_POSTGRES_PASSWORD=geointel \
     GEOINTEL_ALL_IN_ONE=1 \
     PATH="/opt/geointel/venv/bin:${PATH}"
 

deploy/unraid/README.md

@@ -78,6 +78,10 @@ bash deploy/unraid/run-dockerman-container.sh
 
 The repository deploy scripts run the same flow automatically. They validate the Compose reference, build the image with plain `docker build`, install the DockerMan template/icon, remove any old Compose-owned `geointel` container, preserve/migrate the PostGIS data path and start the final container with DockerMan labels.
 
+Database credentials are runtime configuration, not image metadata. The
+all-in-one image does not bake `GEOINTEL_POSTGRES_PASSWORD` into the Dockerfile;
+set it through `.env`, the Unraid template or `docker run -e`.
+
 Validate:
 
 ```bash