A security audit flags that database credentials are visible via `docker inspect` on production hosts

The app's compose.yaml passes DB_PASSWORD via `environment:`. Propose a remediation plan. Expected reasoning: migrate to file-based secret delivery — Docker secrets (Swarm) or, more realistically for most teams, an external secrets manager (Vault/AWS Secrets Manager) that the application fetches from at startup, or Kubernetes Secrets mounted as files if already on K8s. Update the application to read from a file path (or fetch at boot) rather than expecting an env var, then remove the plaintext password from compose.yaml and any committed .env files; rotate the exposed credential as part of rem