v2.1.3 — connection-pool leak defence

Database connection pool made leak-proof.

A shared 100-slot Postgres (BYOI on tech-vm) was exhausted by ~86 idle bss connections while this host held only one live socket — orphans left behind when containers were SIGKILL'd on docker restart, whose FIN/RST never reached Postgres through the bridge NAT, so the server counted the dead sockets as idle until TCP keepalive (~2h). The starved pool killed every later-starting service (com, som, subscription, portal-csr all died on PoolTimedOut / "cockpit store connect failed").

bss-db's pool (crates/bss-db/src/pool.rs), which set only min/max_connections, gains three leak-defence layers:

• client-side idle_timeout (300s) — bursts drain back down
• max_lifetime (1800s) — hard recycle
• server-side idle_session_timeout (10min, sent as a startup -c option) — the orphan backstop: Postgres itself drops any session idle past the window even when the owning client is already gone

min_connections dropped 5→1 (11 processes pin ~11 warm slots instead of ~55), and test_before_acquire is explicit so a server-reaped connection is transparently replaced rather than surfaced as a query error.

Verified live: server footprint 103→21 total, bss 86→12; backstop confirmed applied (idle_session_timeout = 10min) through the real bss_db::connect path.

SemVer patch: reliability only — no product verb, wire contract, event, payload, or DB schema change. All binaries link bss-db, so all 11 images rebuilt.

Also folds the vestigial docker-compose.rust.yml overlay into the base compose file (deployment-drift fix — the split image tags let this fix ship built-but-undeployed for hours).