feat: add PgBouncer in front of PostGIS

[lewismc]

Summary

Adds an internal-only PgBouncer hop for chatty Compose clients so PostGIS is not opened directly by every app/cron connection. Closes #106. Supersedes #196 (greenfield; do not rebase that PR).

Replaces the empty merge of #396 (that PR was merged while feat/106-pgbouncer briefly pointed at main with no PgBouncer commits).

tagbase_server ──┐
docker-cron    ──┼──► pgbouncer:5432 (edoburu, transaction, scram-sha-256)
                 └──► postgis:5432

dbbackups / pgadmin4 / host localhost:5432 ──► postgis (direct)

Changes

• docker-compose.yml / docker-compose.test.yml: pgbouncer service; app/cron use POSTGRES_HOST=pgbouncer
• db_utils.py + cron: honor POSTGRES_HOST / POSTGRES_PORT
• renovate.json: loose versioning for edoburu/pgbouncer
• Merged with main after Remove slack dependency #398 (Slack removal)

Pre-commit / Super Linter lives in #400 (split out of this work).

Test plan

• docker compose up -d --build — pgbouncer healthy; app/cron reach DB
• Host localhost:5432 still hits PostGIS
• Observability smoke / stack tests green
• CI pytest POSTGRES_HOST=localhost path unchanged

Made with Cursor

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[renato2099]

having pgbouncer is good , thanks!