fix: accept DATABASE_URL directly, add POSTGRES_PASSWORD to required vars

brain-api now takes DATABASE_URL as a complete connection string from env
instead of constructing it from POSTGRES_PASSWORD. This matches Portainer's
env var pattern and avoids password duplication.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.portainer.yml

@@ -1,7 +1,8 @@
 # OpenBrain — Portainer / Docker Swarm deployment
 #
 # Required environment variables (set in Portainer stack env):
-#   POSTGRES_PASSWORD   — postgres user password
+#   POSTGRES_PASSWORD   — postgres superuser password (must match DATABASE_URL)
+#   DATABASE_URL        — full postgres connection string
 #   API_KEY             — secret key for API/MCP auth
 #   OLLAMA_URL          — Ollama endpoint (e.g. http://10.x.x.x:11434)
 #   IMAGE_TAG           — image tag to deploy (e.g. sha-abc1234 or latest)
@@ -35,7 +36,7 @@ services:
   brain-api:
     image: git.mosaicstack.dev/mosaic/openbrain:${IMAGE_TAG:-latest}
     environment:
-      DATABASE_URL: postgresql://openbrain:${POSTGRES_PASSWORD}@brain-db:5432/openbrain
+      DATABASE_URL: ${DATABASE_URL}
       API_KEY: ${API_KEY}
       OLLAMA_URL: ${OLLAMA_URL}
       OLLAMA_EMBEDDING_MODEL: ${OLLAMA_EMBEDDING_MODEL:-bge-m3:latest}