fix architecture and write new tests

scripts/docker-prod-up-pgmanage.sh

@@ -5,6 +5,17 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 source "${ROOT_DIR}/scripts/docker-prod-common.sh"
 
-start_prod_services pgmanage
+ensure_env_file
 
-echo "pgManage is starting."
+pgmanage_user="$(read_env_value PGMANAGE_DEFAULT_USERNAME)"
+pgmanage_password="$(read_env_value PGMANAGE_DEFAULT_PASSWORD)"
+if [[ -z "${pgmanage_user}" || -z "${pgmanage_password}" || "${pgmanage_user}" == "admin" || "${pgmanage_password}" == replace-with-* ]]; then
+  echo "Set strong PGMANAGE_DEFAULT_USERNAME and PGMANAGE_DEFAULT_PASSWORD before starting pgManage." >&2
+  exit 1
+fi
+
+echo "Starting pgManage on the private Docker network only."
+echo "Access it with an SSH tunnel or VPN path to the Docker host, not through public Traefik."
+prod_compose --profile private-tools up --build -d pgmanage
+
+echo "pgManage is starting as a private tool."