Complete training workflow and acceptance hardening

scripts/test_production_postgres.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+project="lct-production-check-$$"
+port=$((20000 + $$ % 40000))
+secret="prod-check-$(od -An -N16 -tx1 /dev/urandom | tr -d ' \n')"
+compose=(docker compose -p "$project" -f "$repo_root/docker-compose.yml" \
+  -f "$repo_root/docker-compose.production.yml")
+
+cleanup() {
+  POSTGRES_PASSWORD="$secret" POSTGRES_PORT="$port" \
+    "${compose[@]}" down --volumes --remove-orphans >/dev/null 2>&1 || true
+}
+trap cleanup EXIT INT TERM
+
+if env -u POSTGRES_PASSWORD "${compose[@]}" config --quiet >/dev/null 2>&1; then
+  echo "ОШИБКА: production Compose запустился без POSTGRES_PASSWORD" >&2
+  exit 1
+fi
+
+POSTGRES_PASSWORD="$secret" POSTGRES_PORT="$port" \
+  "${compose[@]}" up --pull never --detach --wait postgres
+
+network="${project}_default"
+docker run --pull never --rm --network "$network" -e "PGPASSWORD=$secret" \
+  postgres:16-alpine psql -h postgres -U lct -d lct -Atc 'select 1' | rg -x '1' >/dev/null
+
+if docker run --pull never --rm --network "$network" -e PGPASSWORD=wrong \
+  postgres:16-alpine psql -h postgres -U lct -d lct -Atc 'select 1' >/dev/null 2>&1; then
+  echo "ОШИБКА: production PostgreSQL принял неверный пароль" >&2
+  exit 1
+fi
+
+echo "Production PostgreSQL принял пароль из backend-сети и отклонил неверный."