deploy: pin the compose network to an explicit /28

The first deploy failed before the health gate:

    Network ai-resume_default Error Error response from daemon:
    all predefined address pools have been fully subnetted

.13's docker daemon has 31 bridge networks already, which exhausts its
default-address-pools, so any new implicit compose network fails to create.
Pinning 10.89.0.0/28 (no route, bridge or LAN overlap on .13) makes this
project independent of that host condition without touching another project,
container or the daemon config. mem_limit, memswap_limit and the 127.0.0.1
port binding are unchanged.

deploy/compose.yml

@@ -43,6 +43,20 @@ services:
       retries: 3
       start_period: 5s
 
+# The project network gets an explicit, small subnet. The host's docker daemon
+# has every default address pool allocated by other projects ("all predefined
+# address pools have been fully subnetted"), so an implicit compose network
+# cannot be created. Pinning /28 of RFC1918 space that no other bridge or route
+# on .13 uses keeps this deploy independent of the host's pool exhaustion and
+# does not touch any other container. Single-service stack: two addresses is
+# plenty.
+networks:
+  default:
+    ipam:
+      config:
+        - subnet: 10.89.0.0/28
+          gateway: 10.89.0.1
+
 # Phase 4/5 add at most three more containers (Qdrant, Prefect worker, query
 # service) inside the 4-container and 1.0 GiB budget in AGENTS.md §4.3. Mode A
 # needs none of them and must keep working when they are stopped (test A1).