fix(12-uat): resolve critical code review findings in gap closure (CR-01 through CR-03, IN-01)

- CR-01: promtail Docker socket mounted :ro (was read-write)
- CR-02: Grafana admin password uses :? fail-fast (was :-changeme default)
- CR-03: DDL privilege test fails not skips when docuvault_app role absent
- IN-01: README version synced to 0.2.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -1,6 +1,6 @@
 # DocuVault
 
-**Version 0.2.0 — Alpha**
+**Version 0.2.1 — Alpha**
 
 > **Not production-ready.** DocuVault is functional for local and self-hosted use but has not been audited or hardened for public internet exposure. APIs, environment variables, and the database schema may change without notice until a stable 1.0 release is declared.
 

backend/tests/test_migration_0006.py

@@ -279,9 +279,18 @@ class TestMigration0005To0006:
             "SELECT has_schema_privilege('docuvault_app', 'public', 'CREATE')"
         )
         row = cur.fetchone()
-        # If the user doesn't exist (integration DB doesn't have it), skip gracefully
+        # Role absence means the DB is misconfigured — fail explicitly rather than silently skipping
+        # the privilege-escalation gate. Set SKIP_ROLE_CHECK=1 to opt out intentionally.
         if row is None:
-            pytest.skip("docuvault_app role does not exist in the integration database")
+            import os
+            if os.environ.get("SKIP_ROLE_CHECK") == "1":
+                pytest.skip("docuvault_app role absent — SKIP_ROLE_CHECK=1 set")
+            else:
+                pytest.fail(
+                    "docuvault_app role does not exist in the integration database. "
+                    "The privilege boundary cannot be verified. "
+                    "Set SKIP_ROLE_CHECK=1 to skip intentionally."
+                )
         assert row[0] is False, (
             "docuvault_app must NOT have CREATE privilege on the public schema — "
             "only docuvault_migrate should be able to run DDL"

docker-compose.yml

@@ -256,7 +256,7 @@ services:
     volumes:
       - ./docker/loki/promtail-config.yaml:/etc/promtail/config.yaml
       - /var/lib/docker/containers:/var/lib/docker/containers:ro
-      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/run/docker.sock:/var/run/docker.sock:ro
     command: -config.file=/etc/promtail/config.yaml
     depends_on:
       - loki
@@ -268,7 +268,7 @@ services:
     environment:
       - GF_AUTH_ANONYMOUS_ENABLED=false
       - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-changeme}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD must be set}
     volumes:
       - grafana_data:/var/lib/grafana
     depends_on: