RHL-005-(chore): do not expose mongodb port in server compose

docker-compose.local.yml

@@ -1,5 +1,10 @@
 services:
+  db:
+    # Local only: publish MongoDB to host (optional, convenient for tools)
+    ports:
+      - "27017:27017"
+
   app:
     volumes:
-      # Local mount: fixture NAS folder
+      # Local only: fixture NAS folder
       - ./.local_nas:/mnt/niederlassungen:ro

docker-compose.yml

@@ -8,8 +8,10 @@ services:
       MONGO_INITDB_ROOT_PASSWORD: supersecret
     volumes:
       - db_data:/data/db
-    ports:
-      - "27017:27017"
+    # Do not publish MongoDB to the host in the base/server compose.
+    # Containers can still reach it via the Compose network (service name: "db").
+    expose:
+      - "27017"
     healthcheck:
       test:
         [