fix(12-uat): resolve critical code review findings in gap closure (CR-01 through CR-03, IN-01)

- CR-01: promtail Docker socket mounted :ro (was read-write)
- CR-02: Grafana admin password uses :? fail-fast (was :-changeme default)
- CR-03: DDL privilege test fails not skips when docuvault_app role absent
- IN-01: README version synced to 0.2.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_migration_0006.py

@@ -279,9 +279,18 @@ class TestMigration0005To0006:
             "SELECT has_schema_privilege('docuvault_app', 'public', 'CREATE')"
         )
         row = cur.fetchone()
-        # If the user doesn't exist (integration DB doesn't have it), skip gracefully
+        # Role absence means the DB is misconfigured — fail explicitly rather than silently skipping
+        # the privilege-escalation gate. Set SKIP_ROLE_CHECK=1 to opt out intentionally.
         if row is None:
-            pytest.skip("docuvault_app role does not exist in the integration database")
+            import os
+            if os.environ.get("SKIP_ROLE_CHECK") == "1":
+                pytest.skip("docuvault_app role absent — SKIP_ROLE_CHECK=1 set")
+            else:
+                pytest.fail(
+                    "docuvault_app role does not exist in the integration database. "
+                    "The privilege boundary cannot be verified. "
+                    "Set SKIP_ROLE_CHECK=1 to skip intentionally."
+                )
         assert row[0] is False, (
             "docuvault_app must NOT have CREATE privilege on the public schema — "
             "only docuvault_migrate should be able to run DDL"