fix(staging): connect web to local postgres

frontend/tests/database-topology.test.ts

@@ -5,9 +5,11 @@ import { startPostgresFixture } from "./helpers/postgres-fixture";
 
 test("staging postgres is private and CI binds loopback only", () => {
   const staging = readFileSync("../deploy/docker-compose.postgres.yml", "utf8");
+  const application = readFileSync("../deploy/docker-compose.staging.yml", "utf8");
   const ci = readFileSync("../deploy/docker-compose.postgres-ci.yml", "utf8");
   assert.match(staging, /image:\s*postgres:17-alpine/);
   assert.doesNotMatch(staging, /^\s+ports:/m);
+  assert.match(application, /web:\s*\n\s+networks:\s*\n\s+- default\s*\n\s+- app/);
   assert.match(ci, /127\.0\.0\.1:\$\{POSTGRES_HOST_PORT:-55432\}:5432/);
 });
 

frontend/tests/staging-backend-workflows.test.ts

@@ -316,6 +316,7 @@ test("first immutable deployment rolls back to validated local image IDs", () =>
 
 test("normal deployment checks migrations but never applies them", () => {
   const runner = read(deployScript);
+  assert.match(runner, /-f deploy\/docker-compose\.staging\.yml/);
   assertOrder(runner, [
     "pull api web",
     "up -d --no-build --pull never --wait postgres",
@@ -327,6 +328,8 @@ test("normal deployment checks migrations but never applies them", () => {
   assert.doesNotMatch(runner, /--profile migration run --rm migrator/);
   assert.doesNotMatch(runner, /npm\s+run\s+db:migrate(?!:check)/);
   assert.doesNotMatch(runner, /pull api web postgres/);
+  assert.match(runner, /adminRoot\.status !== 302/);
+  assert.match(runner, /adminRoot\.headers\.get\("location"\) !== "\/admin\/codes"/);
 });
 
 test("manual migration uses only PostgreSQL and the digest-pinned migrator", () => {