ci: pin db image instead of rebuilding in CI

Dockerfile.pg installs TimescaleDB from packagecloud.io, which the Pi's
network cannot reach (ISP abuse-mitigation blackholes AWS ranges after the
masscan incident). Every CI deploy rebuilt the DB image and failed on the
packagecloud fetch, blocking all pipelines.

The DB image is now built once manually (docker compose build db) and
pinned as localhost/osint-dashboard-pg:latest; compose up uses it directly.
The app build only needs deb.debian.org + pypi + the docker daemon's
registry mirror, all reachable.

docker-compose.yml

@@ -14,10 +14,13 @@ name: osint-dashboard
 
 services:
   db:
-    build:
-      context: .
-      dockerfile: Dockerfile.pg
-      platforms: ["linux/arm64"]
+    # NO build: block here on purpose. The DB image (TimescaleDB+PostGIS) is
+    # built once via Dockerfile.pg and pinned as localhost/osint-dashboard-pg.
+    # Dockerfile.pg installs TimescaleDB from packagecloud.io, which some
+    # networks (and ISP abuse-mitigation blackholes) block, so rebuilding it
+    # on every CI deploy made the pipeline flaky. Rebuild manually when the
+    # base image or extensions need bumping:
+    #   docker compose build db && docker compose up -d db
     image: localhost/osint-dashboard-pg:latest
     container_name: osint-db
     restart: unless-stopped