docs(ops): describe the move to a newer Postgres major

The compose file stays on 16. Changing only the image line stops the stack:
the 18 image refuses a data directory from an older major and expects its
volume one level up. The runbook walks the dump and restore into a fresh
volume, keeps the old one as the way back, and is linked from the update
section and the compose pin.

docker-compose.yml

@@ -577,7 +577,8 @@ services:
     # change (at pin time `16-alpine` resolved to this same digest, so
     # existing deployments see no image change). Minor releases share
     # the on-disk format — bumping this pin is safe without a dump /
-    # restore; a major-version bump (17+) is not.
+    # restore; a major-version bump (17+) is not, see
+    # docs/ops/postgres-major-upgrade.md.
     #
     # The pin only works as long as something watches it: PostgreSQL
     # publishes minor releases with security and data-corruption fixes and