docs(self-hosting): reconcile DATABASE_URL/POSTGRES_PASSWORD guidance with the compose contract

The bundled compose constructs DATABASE_URL inside the app service from
POSTGRES_PASSWORD, so the getting-started 'edit CHANGE-ME' step was a
no-op and .env.example's literal POSTGRES_PASSWORD collided with the
quick-start's appended one. Comment both out in .env.example so the
append pattern yields a single key, and rewrite step 2 to state compose
derives the URL. Add a first-user note to close public registration on
an internet-exposed host and to save the password (no-SMTP CLI reset).
Refresh the stale onboarding step-2 source comment.

.env.example

@@ -18,15 +18,24 @@
 # -----------------------------------------------------------------------------
 # Database
 # -----------------------------------------------------------------------------
-# When using docker-compose.yml: the app container reaches Postgres via the
-# service name "db", so the hostname is "db" — NOT "localhost".
-# When developing without Docker (`pnpm dev` against a host-installed Postgres):
-# change the hostname to "localhost" and adjust the credentials.
-DATABASE_URL="postgresql://healthlog:CHANGE-ME@db:5432/healthlog?schema=public"
+# Bundled docker-compose.yml path (the common case): you do NOT set DATABASE_URL
+# here. Compose CONSTRUCTS it inside the `app` service from POSTGRES_PASSWORD
+# (see docker-compose.yml — the `environment:` block wins over any value in this
+# file), so a DATABASE_URL line here is ignored for that stack. Set only
+# POSTGRES_PASSWORD below and compose wires the connection string for you.
+#
+# Bare-Node / custom-compose path (`pnpm dev` against a host Postgres, or your
+# own compose that does NOT derive DATABASE_URL): uncomment DATABASE_URL and set
+# it explicitly. Hostname is "db" on the bundled compose network, or
+# "localhost" for a host-installed Postgres.
+# DATABASE_URL="postgresql://healthlog:YOUR_PASSWORD@localhost:5432/healthlog?schema=public"
 
-# Postgres password — used both by the db service AND by DATABASE_URL above.
-# Pick a strong random password, e.g. `openssl rand -hex 32`.
-POSTGRES_PASSWORD="CHANGE-ME"
+# Postgres password for the bundled `db` service — and the value compose splices
+# into DATABASE_URL. The quick-start appends a generated one:
+#   echo "POSTGRES_PASSWORD=$(openssl rand -hex 32)" >> .env
+# Left commented here so that append does not create a duplicate key. Uncomment
+# and set it directly instead if you prefer to edit the file by hand.
+# POSTGRES_PASSWORD="generate-with-openssl-rand-hex-32"
 
 
 # -----------------------------------------------------------------------------