fix: misc tech debt

- ci: resolve UPSTREAM_IMAGE_TAG via dotenv artifact (resolve-tag job)
  GitLab quirk — $IMAGE_TAG в trigger.variables не интерполируется
  напрямую от upstream global vars; dotenv делает значение job-local,
  тогда interpolation работает.
- projection-writer: management.server.port=8082 + web-application-type=none
  Возврат actuator/health probes — Spring Boot non-web app не имеет
  HTTP сервера; вынесли actuator на отдельный management server.
- docker-compose.yml: локальный dev-стек (PG + Kafka + Redis + 3 services)
  через repo.nstart.cloud/terravault images. Включается профилем 'dev'.

.gitlab-ci.yml

@@ -127,26 +127,44 @@ docker-migrations:
     - *publish_script
 
 # ─── TRIGGER DEPLOY (downstream pipeline) ──────
+# GitLab quirk: variables: в trigger job НЕ интерполируются от upstream global
+# variables напрямую — `$IMAGE_TAG` передавался как литерал. Workaround:
+# resolve-tag job записывает значение в dotenv artifact, тогда оно становится
+# job-level variable trigger job'а и interpolation работает.
+
+resolve-tag:
+  stage: trigger-deploy
+  image: repo.nstart.cloud/library/alpine:3.20
+  needs: [maven-package]
+  script:
+    - echo "RESOLVED_IMAGE_TAG=$IMAGE_TAG" > resolved.env
+    - cat resolved.env
+  artifacts:
+    reports:
+      dotenv: resolved.env
+
 trigger-deploy-staging:
   stage: trigger-deploy
+  needs: [resolve-tag]
   trigger:
     project: 2-6/2-6-4/terravault/ordinis-infra
     branch: main
     strategy: depend
   variables:
-    UPSTREAM_IMAGE_TAG: $IMAGE_TAG
+    UPSTREAM_IMAGE_TAG: $RESOLVED_IMAGE_TAG
     DEPLOY_ENV: staging
   rules:
     - if: '$CI_COMMIT_BRANCH == "main"'
 
 trigger-deploy-prod:
   stage: trigger-deploy
+  needs: [resolve-tag]
   trigger:
     project: 2-6/2-6-4/terravault/ordinis-infra
     branch: main
     strategy: depend
   variables:
-    UPSTREAM_IMAGE_TAG: $IMAGE_TAG
+    UPSTREAM_IMAGE_TAG: $RESOLVED_IMAGE_TAG
     DEPLOY_ENV: prod
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'