fix(cli): refuse to regenerate POSTGRES_PASSWORD when a data volume already exists

[santhiprakash]

Summary

openship up --compose no longer silently mints a new POSTGRES_PASSWORD when an existing <project>_postgres_data volume is present and the current .env is missing the key. The dry-run plan now reports this unsafe case, and a real run throws a clear recovery message instead of overwriting the secret.

Motivation

Fixes #488. Re-running openship up over an existing install could show POSTGRES_PASSWORD=<preserved> in the dry-run plan while the .env it wrote contained a newly generated value. Postgres only applies POSTGRES_PASSWORD at initdb time, so the volume kept the old password while the API used the new one, failing with password authentication failed for user "openship" (28P01).

Related issue

Closes #488

Changes

• apps/cli/src/lib/compose.ts
  • Add keepPostgresPassword: carry the existing .env value, generate only on a genuine fresh install, and refuse (real run) or warn (dry run) when an initialized data volume exists but POSTGRES_PASSWORD is missing.
  • Thread a dryRun flag through renderEnv so the preview renders a placeholder while the real run enforces the guard.
  • Add warnings to ComposePlan and emit the volume-warning message in composePlan instead of claiming the secret is preserved.
• apps/cli/src/lib/up-plan.ts: print compose plan warnings in the dry-run summary.
• apps/cli/test/unit/compose-env-preserve.test.ts: add tests for preservation, refusal, and dry-run warning.
• apps/cli/test/e2e/up-dry-run.test.ts: update the composePlan mock to include warnings.

Verification

cd apps/cli
bun run lint            # tsc --noEmit, exit 0
bun run test            # 27 files, 228 tests pass
bun run test -- compose-env-preserve  # 28 tests pass
bun run test -- up-dry-run            # 7 tests pass

Note on bun format: running the root bun format script rewrites pre-existing prettier drift in files I did not change (e.g. apps/cli/src/lib/compose.ts has unrelated long-line formatting drift). I left that untouched and hand-formatted the changed lines to the repo's existing style, matching the approach in #385.

Checklist

• One change per PR — one bug, with nothing unrelated bundled in
• The diff is scoped — no reformatting or lint fixes on lines I wasn't otherwise changing
• A test fails without this change and passes with it
• bun run test and bun run --cwd apps/cli lint pass locally
• I understand every line of this diff and can explain it in review