chore(backend): rename docker-compose.yml -> compose.yml + podman notes

Compose v2 canonical filename (compose.yml) is recognized by both
docker compose and podman compose without preference. The previous
docker-compose.yml worked but signalled a Docker-first stance, while
target deployment is Podman 5.8+ rootless.

- Rename backend/docker-compose.yml -> backend/compose.yml.
- backend/README.md `make db-up` comment uses $(CONTAINER) to mirror
  the Makefile auto-detect (lines 14-16: docker || podman).
- backend/README.md audit-writer bootstrap snippet hints at podman
  fallback explicitly with `command -v` runtime sniff.
- backend/compose.yml comment for audit-writer mentions both runtimes.

No functional change. Makefile $(COMPOSE) target unchanged: Compose v2
discovers compose.yml first in its search order.

backend/compose.yml

@@ -0,0 +1,28 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    container_name: mimic-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-mimic}
+      POSTGRES_USER: ${POSTGRES_USER:-mimic_app}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mimic_dev_password}
+    ports:
+      - "127.0.0.1:5432:5432"
+    volumes:
+      - mimic_pgdata:/var/lib/postgresql/data
+    # The `mimic_audit_writer` role is provisioned by the Ansible playbook
+    # in prod (D-010). For dev, create it manually after `make db-up`
+    # (substitute `podman` for `docker` if your runtime is Podman):
+    #   docker exec -it mimic-postgres psql -U mimic_app -d mimic \
+    #     -c "CREATE ROLE mimic_audit_writer LOGIN PASSWORD '<choose one>';"
+    # Then expose the same secret in MIMIC_DATABASE_AUDIT_URL in your .env.
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-mimic_app} -d ${POSTGRES_DB:-mimic}"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+volumes:
+  mimic_pgdata:
+    name: mimic_pgdata