chore(deps): move the database pin to 16.15 and watch it

The bundled PostgreSQL was pinned to 16.14 while 16.15 had been out for
five weeks. The pin itself is deliberate, a database change should be
reviewable rather than whatever the registry serves on pull day, but
nothing watched it: Dependabot was configured with the docker ecosystem,
which reads the Dockerfile and never opens a compose file, so no update
PR was ever raised. CI and the integration suite meanwhile run against
the floating 16-alpine, so the shipped database was older than the
tested one.

Adds the docker-compose ecosystem so each PostgreSQL minor release
arrives as a reviewable PR, moves the pin to 16.15, and pins both halves
with a test that fails if the exact minor or the watch is dropped.
Refs #987

.github/dependabot.yml

@@ -29,3 +29,12 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 3
+  # The `docker` ecosystem above reads the Dockerfile only. The bundled
+  # database lives in `docker-compose.yml`, which GitHub treats as its own
+  # ecosystem, so without this block a new PostgreSQL minor release never
+  # reaches us and the pin ages silently.
+  - package-ecosystem: "docker-compose"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3