security updates

dev/supabase/docker-compose.override.yml

@@ -1,13 +1,39 @@
 # Dev override: attach kong + edge functions to the external "dev_edge" network
 # so the shared Caddy and the dev frps can reach them by DNS name, and set the
 # dev tunnel base domain for the on-demand-TLS authorizer + frps auth plugin.
+#
+# COLLISION-PROOFING (alias-residual elimination):
+#  * The dev service KEYS are now globally unique (kong-dev / functions-dev), so
+#    the auto service-name alias on the Caddy-shared "dev_edge" network is the
+#    UNIQUE *-dev name -- a bare logical name (kong/functions) can never resolve
+#    to a dev container from Caddy.
+#  * The bare names are re-exposed ONLY on the internal project "default" network
+#    (which Caddy is NOT attached to) so every in-stack consumer that still uses
+#    http://kong:8000 / http://functions:9000 (kong.yml, edge-fn source, studio /
+#    functions env, vector) keeps resolving with zero changes.
 services:
-  kong:
-    networks: [default, dev_edge]
-  functions:
-    networks: [default, dev_edge]
+  kong-dev:
+    networks:
+      default:
+        aliases:
+          - kong
+      dev_edge:
+        aliases:
+          - kong-dev
+  functions-dev:
+    networks:
+      default:
+        aliases:
+          - functions
+      dev_edge:
+        aliases:
+          - functions-dev
+      ask-delegation: {}
     environment:
       TUNNEL_BASE_DOMAIN: dev.linumiq.net
 networks:
   dev_edge:
     external: true
+  # On-demand-TLS ask delegation network (shared with prod edge authorizer).
+  ask-delegation:
+    external: true