fix: harden Nexus runtime health and rollback

compose.yaml

@@ -2,6 +2,15 @@ name: nexus
 services:
   postgres:
     image: postgres:17-alpine
+    # WAL-Archivierung bleibt deaktiviert, bis ein verwaltetes Off-Server-Ziel
+    # mit Retention und Restore-Test existiert. Ein lokales Endlosarchiv ist
+    # kein Backup und kann bei Fehlern pg_wal ungebremst wachsen lassen.
+    command:
+      - postgres
+      - -c
+      - archive_mode=off
+      - -c
+      - archive_command=
     restart: always
     deploy:
       resources:
@@ -50,7 +59,7 @@ services:
       Jwt__Audience: ${JWT_AUDIENCE:-nexus-web}
       Bootstrap__OwnerEmail: ${BOOTSTRAP_OWNER_EMAIL:?Set BOOTSTRAP_OWNER_EMAIL in .env}
       # Initial owner password is generated once at first seed and then lives only in the DB.
-      Integrations__OpenClaw__BaseUrl: ${OPENCLAW_BASE_URL:-http://host.docker.internal:18789}
+      Integrations__OpenClaw__BaseUrl: ${OPENCLAW_BASE_URL:-http://openclaw-gateway-bao:18789}
       Integrations__OpenClaw__Token: ${OPENCLAW_GATEWAY_TOKEN:-}
       Integrations__OpenClaw__Password: ${OPENCLAW_GATEWAY_PASSWORD:-}
       Admin__ResetToken: ${Admin__ResetToken:-}
@@ -59,7 +68,7 @@ services:
       - host.docker.internal:host-gateway
     depends_on:
       postgres:
-        condition: service_started
+        condition: service_healthy
         restart: true
     healthcheck:
       test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/health/live || exit 1"]
@@ -106,7 +115,7 @@ services:
       - "127.0.0.1:18880:80"
     depends_on:
       api:
-        condition: service_started
+        condition: service_healthy
         restart: true
     healthcheck:
       test: ["CMD-SHELL", "curl -f http://localhost:80/ || exit 1"]