feat(ledger): add docker-compose smoke test for ledger stack

[tiana-code]

What

Adds a runnable two-service stack and a CI smoke that proves the ledger boots to a healthy state against a real PostgreSQL in under 30 seconds, closing the last open Epic E-01 ops acceptance criterion and the deferred live docker-compose dev boot (#62 AC-5).

• docker-compose.yml (root): ledger (built from the root distroless Dockerfile) + postgres:17-alpine. Postgres carries a pg_isready healthcheck; ledger waits on service_healthy and reaches Postgres by service name via SPRING_DATASOURCE_* env. No broker, no IdP (the ledger has no Kafka dependency and the OAuth2 resource server uses a lazy decoder, so an unreachable KEYCLOAK_ISSUER_URI does not block readiness).
• scripts/demo.sh: strict bash smoke, polls /actuator/health/readiness every 2s up to 30s, then asserts liveness and /v3/api-docs 200. Runnable locally and from CI.
• .github/workflows/ci.yml: new compose-smoke job (needs: build-test) that builds the stack, runs the smoke, dumps container logs on failure, and tears the stack down unconditionally.

Design notes

• The distroless runtime has no shell or curl, so the ledger service intentionally has no in-container healthcheck (a CMD-SHELL/curl probe would make it permanently unhealthy). The host-side demo.sh poll is the binding readiness gate; only postgres carries a healthcheck.
• Readiness gates on HTTP 200 of the probe (Boot maps UP to 200, not-UP to 503), which is the authoritative aggregate signal and avoids matching a per-component status under show-components: always.

Verification

Infra + bash + CI only, zero Kotlin/app/migration changes. WSL has no Docker, so the compose-smoke CI job is the binding evidence. Gate chain: analyst, architect, critic (GO-WITH-CHANGES, folded), code-reviewer, security-auditor (PASS).

Closes #66