feat(cli): add application container to docker demo; make mssql opt-in

[nadeem4]

Task 13 of the 14-task plan.

nl2sql setup --demo --docker generated a compose file with four database
services and no application, so the demo could not actually answer a query
without the user installing and wiring up nl2sql by hand. MSSQL also forced a
~1.6 GB pull before anything came up.

What changed

• DOCKER_COMPOSE_TEMPLATE gains an app service: built from the repo root
  (context: .., dockerfile: packages/api/Dockerfile), publishes 8000:8000,
  reads the same .env.demo the lite path writes (env_file: ../.env.demo),
  mounts ../configs and ../data, and waits on the three databases with
  condition: service_healthy (all three declare healthchecks;
  manufacturing_history does not, and nothing depends on it).
• manufacturing_history is now behind profiles: ["mssql"]. Nothing outside
  the profile depends on it, so the default up never resolves it.
• DemoManager.setup_docker now always writes .env.demo, instead of behind a
  prompt: the app service's env_file must exist or Compose refuses to start
  (and docker compose config fails). The corresponding confirm prompt in
  setup_command is gone; the next-steps panel documents the API port and the
  --profile mssql opt-in.
• packages/api/Dockerfile now builds from the repo instead of PyPI. It
  installed nl2sql and nl2sql-api from PyPI, where nothing is published yet,
  so it could not build at all. It now copies packages/adapter-sdk,
  packages/nl2sql and packages/api from the build context and installs
  ./packages/adapter-sdk, ./packages/nl2sql[postgres,mysql] and
  ./packages/api. The NL2SQL_EXTRAS build arg is gone; the extras are in the
  install line.
• .gitignore gains demo_docker/ — stated explicitly rather than quietly: the
  directory setup --demo --docker generates was not ignored, and it contains
  generated database passwords.

Tests

No docker-writer tests existed before this PR. Nothing under
packages/nl2sql/tests/ referenced DockerWriter, write_docker, or
docker-compose.demo, so packages/nl2sql/tests/cli/test_demo_docker_compose.py
is the first coverage for this writer. It generates the stack through the writer,
parses the compose file with yaml.safe_load, and asserts the app service, its
port, its .env.demo env file, service_healthy dependencies, the mssql
profile on manufacturing_history, and that nothing outside that profile depends
on it. Written first: 5 of the 6 failed against the old template
(KeyError: 'app', KeyError: 'profiles').

Unit: 225 passed, 1 skipped, 47 deselected before; 231 passed, 1 skipped,
47 deselected after. Key-free integration: 28 passed, unchanged. Both suites run
twice under pytest-randomly.

Compose validation

Validated with a real docker compose config run (Docker 28.0.4) against
generated output; no images pulled, nothing started.

Default (docker compose -f docker-compose.demo.yml config --services):

manufacturing_ops
manufacturing_ref
manufacturing_supply
app

With --profile mssql:

manufacturing_history
manufacturing_ops
manufacturing_ref
manufacturing_supply
app

Both resolve cleanly. app's depends_on resolves to service_healthy on the
three database services and nothing references manufacturing_history outside
the profile.

Known gap, not addressed here

configs/datasources.demo.yaml for the docker demo points every datasource at
localhost:<published port>, which is correct from the host but does not resolve
from inside the app container. The compose stack starts as specified, but a
query issued against the containerised API would not reach the databases until
that config grows a container-side host. Changing it would break the documented
host-side nl2sql --env demo index / run workflow, so it is left for a
follow-up decision rather than changed here.

[nadeem4]

Task 13 of the 14-task plan.

nl2sql setup --demo --docker generated a compose file with four database
services and no application, so the demo could not actually answer a query
without the user installing and wiring up nl2sql by hand. MSSQL also forced a
~1.6 GB pull before anything came up.

What changed

• DOCKER_COMPOSE_TEMPLATE gains an app service: built from the repo root
  (context: .., dockerfile: packages/api/Dockerfile), publishes 8000:8000,
  reads the same .env.demo the lite path writes (env_file: ../.env.demo),
  mounts ../configs and ../data, and waits on the three databases with
  condition: service_healthy (all three declare healthchecks;
  manufacturing_history does not, and nothing depends on it).
• manufacturing_history is now behind profiles: ["mssql"]. Nothing outside
  the profile depends on it, so the default up never resolves it.
• DemoManager.setup_docker now always writes .env.demo, instead of behind a
  prompt: the app service's env_file must exist or Compose refuses to start
  (and docker compose config fails). The corresponding confirm prompt in
  setup_command is gone; the next-steps panel documents the API port and the
  --profile mssql opt-in.
• packages/api/Dockerfile now builds from the repo instead of PyPI. It
  installed nl2sql and nl2sql-api from PyPI, where nothing is published yet,
  so it could not build at all. It now copies packages/adapter-sdk,
  packages/nl2sql and packages/api from the build context and installs
  ./packages/adapter-sdk, ./packages/nl2sql[postgres,mysql] and
  ./packages/api. The NL2SQL_EXTRAS build arg is gone; the extras are in the
  install line.
• .gitignore gains demo_docker/ — stated explicitly rather than quietly: the
  directory setup --demo --docker generates was not ignored, and it contains
  generated database passwords.

Tests

No docker-writer tests existed before this PR. Nothing under
packages/nl2sql/tests/ referenced DockerWriter, write_docker, or
docker-compose.demo, so packages/nl2sql/tests/cli/test_demo_docker_compose.py
is the first coverage for this writer. It generates the stack through the writer,
parses the compose file with yaml.safe_load, and asserts the app service, its
port, its .env.demo env file, service_healthy dependencies, the mssql
profile on manufacturing_history, and that nothing outside that profile depends
on it. Written first: 5 of the 6 failed against the old template
(KeyError: 'app', KeyError: 'profiles').

Unit: 225 passed, 1 skipped, 47 deselected before; 231 passed, 1 skipped,
47 deselected after. Key-free integration: 28 passed, unchanged. Both suites run
twice under pytest-randomly.

Compose validation

Validated with a real docker compose config run (Docker 28.0.4) against
generated output; no images pulled, nothing started.

Default (docker compose -f docker-compose.demo.yml config --services):

manufacturing_ops
manufacturing_ref
manufacturing_supply
app

With --profile mssql:

manufacturing_history
manufacturing_ops
manufacturing_ref
manufacturing_supply
app

Both resolve cleanly. app's depends_on resolves to service_healthy on the
three database services and nothing references manufacturing_history outside
the profile.

Known gap, not addressed here

configs/datasources.demo.yaml for the docker demo points every datasource at
localhost:<published port>, which is correct from the host but does not resolve
from inside the app container. The compose stack starts as specified, but a
query issued against the containerised API would not reach the databases until
that config grows a container-side host. Changing it would break the documented
host-side nl2sql --env demo index / run workflow, so it is left for a
follow-up decision rather than changed here.

[nadeem4]

Task 13 of the 14-task plan.

nl2sql setup --demo --docker generated a compose file with four database
services and no application, so the demo could not actually answer a query
without the user installing and wiring up nl2sql by hand. MSSQL also forced a
~1.6 GB pull before anything came up.

What changed

• DOCKER_COMPOSE_TEMPLATE gains an app service: built from the repo root
  (context: .., dockerfile: packages/api/Dockerfile), publishes 8000:8000,
  reads the same .env.demo the lite path writes (env_file: ../.env.demo),
  mounts ../configs and ../data, and waits on the three databases with
  condition: service_healthy (all three declare healthchecks;
  manufacturing_history does not, and nothing depends on it).
• manufacturing_history is now behind profiles: ["mssql"]. Nothing outside
  the profile depends on it, so the default up never resolves it.
• DemoManager.setup_docker now always writes .env.demo, instead of behind a
  prompt: the app service's env_file must exist or Compose refuses to start
  (and docker compose config fails). The corresponding confirm prompt in
  setup_command is gone; the next-steps panel documents the API port and the
  --profile mssql opt-in.
• packages/api/Dockerfile now builds from the repo instead of PyPI. It
  installed nl2sql and nl2sql-api from PyPI, where nothing is published yet,
  so it could not build at all. It now copies packages/adapter-sdk,
  packages/nl2sql and packages/api from the build context and installs
  ./packages/adapter-sdk, ./packages/nl2sql[postgres,mysql] and
  ./packages/api. The NL2SQL_EXTRAS build arg is gone; the extras are in the
  install line.
• .gitignore gains demo_docker/ — stated explicitly rather than quietly: the
  directory setup --demo --docker generates was not ignored, and it contains
  generated database passwords.

Tests

No docker-writer tests existed before this PR. Nothing under
packages/nl2sql/tests/ referenced DockerWriter, write_docker, or
docker-compose.demo, so packages/nl2sql/tests/cli/test_demo_docker_compose.py
is the first coverage for this writer. It generates the stack through the writer,
parses the compose file with yaml.safe_load, and asserts the app service, its
port, its .env.demo env file, service_healthy dependencies, the mssql
profile on manufacturing_history, and that nothing outside that profile depends
on it. Written first: 5 of the 6 failed against the old template
(KeyError: 'app', KeyError: 'profiles').

Unit: 225 passed, 1 skipped, 47 deselected before; 231 passed, 1 skipped,
47 deselected after. Key-free integration: 28 passed, unchanged. Both suites run
twice under pytest-randomly.

Compose validation

Validated with a real docker compose config run (Docker 28.0.4) against
generated output; no images pulled, nothing started.

Default (docker compose -f docker-compose.demo.yml config --services):

manufacturing_ops
manufacturing_ref
manufacturing_supply
app

With --profile mssql:

manufacturing_history
manufacturing_ops
manufacturing_ref
manufacturing_supply
app

Both resolve cleanly. app's depends_on resolves to service_healthy on the
three database services and nothing references manufacturing_history outside
the profile.

Known gap, not addressed here

configs/datasources.demo.yaml for the docker demo points every datasource at
localhost:<published port>, which is correct from the host but does not resolve
from inside the app container. The compose stack starts as specified, but a
query issued against the containerised API would not reach the databases until
that config grows a container-side host. Changing it would break the documented
host-side nl2sql --env demo index / run workflow, so it is left for a
follow-up decision rather than changed here.

[nadeem4]

Task 13 of the 14-task plan.

nl2sql setup --demo --docker generated a compose file with four database
services and no application, so the demo could not actually answer a query
without the user installing and wiring up nl2sql by hand. MSSQL also forced a
~1.6 GB pull before anything came up.

What changed

• DOCKER_COMPOSE_TEMPLATE gains an app service: built from the repo root
  (context: .., dockerfile: packages/api/Dockerfile), publishes 8000:8000,
  reads the same .env.demo the lite path writes (env_file: ../.env.demo),
  mounts ../configs and ../data, and waits on the three databases with
  condition: service_healthy (all three declare healthchecks;
  manufacturing_history does not, and nothing depends on it).
• manufacturing_history is now behind profiles: ["mssql"]. Nothing outside
  the profile depends on it, so the default up never resolves it.
• DemoManager.setup_docker now always writes .env.demo, instead of behind a
  prompt: the app service's env_file must exist or Compose refuses to start
  (and docker compose config fails). The corresponding confirm prompt in
  setup_command is gone; the next-steps panel documents the API port and the
  --profile mssql opt-in.
• packages/api/Dockerfile now builds from the repo instead of PyPI. It
  installed nl2sql and nl2sql-api from PyPI, where nothing is published yet,
  so it could not build at all. It now copies packages/adapter-sdk,
  packages/nl2sql and packages/api from the build context and installs
  ./packages/adapter-sdk, ./packages/nl2sql[postgres,mysql] and
  ./packages/api. The NL2SQL_EXTRAS build arg is gone; the extras are in the
  install line.
• .gitignore gains demo_docker/ — stated explicitly rather than quietly: the
  directory setup --demo --docker generates was not ignored, and it contains
  generated database passwords.

Tests

No docker-writer tests existed before this PR. Nothing under
packages/nl2sql/tests/ referenced DockerWriter, write_docker, or
docker-compose.demo, so packages/nl2sql/tests/cli/test_demo_docker_compose.py
is the first coverage for this writer. It generates the stack through the writer,
parses the compose file with yaml.safe_load, and asserts the app service, its
port, its .env.demo env file, service_healthy dependencies, the mssql
profile on manufacturing_history, and that nothing outside that profile depends
on it. Written first: 5 of the 6 failed against the old template
(KeyError: 'app', KeyError: 'profiles').

Unit: 225 passed, 1 skipped, 47 deselected before; 231 passed, 1 skipped,
47 deselected after. Key-free integration: 28 passed, unchanged. Both suites run
twice under pytest-randomly.

Compose validation

Validated with a real docker compose config run (Docker 28.0.4) against
generated output; no images pulled, nothing started.

Default (docker compose -f docker-compose.demo.yml config --services):

manufacturing_ops
manufacturing_ref
manufacturing_supply
app

With --profile mssql:

manufacturing_history
manufacturing_ops
manufacturing_ref
manufacturing_supply
app

Both resolve cleanly. app's depends_on resolves to service_healthy on the
three database services and nothing references manufacturing_history outside
the profile.

Known gap, not addressed here

configs/datasources.demo.yaml for the docker demo points every datasource at
localhost:<published port>, which is correct from the host but does not resolve
from inside the app container. The compose stack starts as specified, but a
query issued against the containerised API would not reach the databases until
that config grows a container-side host. Changing it would break the documented
host-side nl2sql --env demo index / run workflow, so it is left for a
follow-up decision rather than changed here.

[nadeem4]

Task 13 of the 14-task plan.

nl2sql setup --demo --docker generated a compose file with four database
services and no application, so the demo could not actually answer a query
without the user installing and wiring up nl2sql by hand. MSSQL also forced a
~1.6 GB pull before anything came up.

What changed

• DOCKER_COMPOSE_TEMPLATE gains an app service: built from the repo root
  (context: .., dockerfile: packages/api/Dockerfile), publishes 8000:8000,
  reads the same .env.demo the lite path writes (env_file: ../.env.demo),
  mounts ../configs and ../data, and waits on the three databases with
  condition: service_healthy (all three declare healthchecks;
  manufacturing_history does not, and nothing depends on it).
• manufacturing_history is now behind profiles: ["mssql"]. Nothing outside
  the profile depends on it, so the default up never resolves it.
• DemoManager.setup_docker now always writes .env.demo, instead of behind a
  prompt: the app service's env_file must exist or Compose refuses to start
  (and docker compose config fails). The corresponding confirm prompt in
  setup_command is gone; the next-steps panel documents the API port and the
  --profile mssql opt-in.
• packages/api/Dockerfile now builds from the repo instead of PyPI. It
  installed nl2sql and nl2sql-api from PyPI, where nothing is published yet,
  so it could not build at all. It now copies packages/adapter-sdk,
  packages/nl2sql and packages/api from the build context and installs
  ./packages/adapter-sdk, ./packages/nl2sql[postgres,mysql] and
  ./packages/api. The NL2SQL_EXTRAS build arg is gone; the extras are in the
  install line.
• .gitignore gains demo_docker/ — stated explicitly rather than quietly: the
  directory setup --demo --docker generates was not ignored, and it contains
  generated database passwords.

Tests

No docker-writer tests existed before this PR. Nothing under
packages/nl2sql/tests/ referenced DockerWriter, write_docker, or
docker-compose.demo, so packages/nl2sql/tests/cli/test_demo_docker_compose.py
is the first coverage for this writer. It generates the stack through the writer,
parses the compose file with yaml.safe_load, and asserts the app service, its
port, its .env.demo env file, service_healthy dependencies, the mssql
profile on manufacturing_history, and that nothing outside that profile depends
on it. Written first: 5 of the 6 failed against the old template
(KeyError: 'app', KeyError: 'profiles').

Unit: 225 passed, 1 skipped, 47 deselected before; 231 passed, 1 skipped,
47 deselected after. Key-free integration: 28 passed, unchanged. Both suites run
twice under pytest-randomly.

Compose validation

Validated with a real docker compose config run (Docker 28.0.4) against
generated output; no images pulled, nothing started.

Default (docker compose -f docker-compose.demo.yml config --services):

manufacturing_ops
manufacturing_ref
manufacturing_supply
app

With --profile mssql:

manufacturing_history
manufacturing_ops
manufacturing_ref
manufacturing_supply
app

Both resolve cleanly. app's depends_on resolves to service_healthy on the
three database services and nothing references manufacturing_history outside
the profile.

Known gap, not addressed here

configs/datasources.demo.yaml for the docker demo points every datasource at
localhost:<published port>, which is correct from the host but does not resolve
from inside the app container. The compose stack starts as specified, but a
query issued against the containerised API would not reach the databases until
that config grows a container-side host. Changing it would break the documented
host-side nl2sql --env demo index / run workflow, so it is left for a
follow-up decision rather than changed here.

[nadeem4]

Task 13 of the 14-task plan.

nl2sql setup --demo --docker generated a compose file with four database
services and no application, so the demo could not actually answer a query
without the user installing and wiring up nl2sql by hand. MSSQL also forced a
~1.6 GB pull before anything came up.

What changed

• DOCKER_COMPOSE_TEMPLATE gains an app service: built from the repo root
  (context: .., dockerfile: packages/api/Dockerfile), publishes 8000:8000,
  reads the same .env.demo the lite path writes (env_file: ../.env.demo),
  mounts ../configs and ../data, and waits on the three databases with
  condition: service_healthy (all three declare healthchecks;
  manufacturing_history does not, and nothing depends on it).
• manufacturing_history is now behind profiles: ["mssql"]. Nothing outside
  the profile depends on it, so the default up never resolves it.
• DemoManager.setup_docker now always writes .env.demo, instead of behind a
  prompt: the app service's env_file must exist or Compose refuses to start
  (and docker compose config fails). The corresponding confirm prompt in
  setup_command is gone; the next-steps panel documents the API port and the
  --profile mssql opt-in.
• packages/api/Dockerfile now builds from the repo instead of PyPI. It
  installed nl2sql and nl2sql-api from PyPI, where nothing is published yet,
  so it could not build at all. It now copies packages/adapter-sdk,
  packages/nl2sql and packages/api from the build context and installs
  ./packages/adapter-sdk, ./packages/nl2sql[postgres,mysql] and
  ./packages/api. The NL2SQL_EXTRAS build arg is gone; the extras are in the
  install line.
• .gitignore gains demo_docker/ — stated explicitly rather than quietly: the
  directory setup --demo --docker generates was not ignored, and it contains
  generated database passwords.

Tests

No docker-writer tests existed before this PR. Nothing under
packages/nl2sql/tests/ referenced DockerWriter, write_docker, or
docker-compose.demo, so packages/nl2sql/tests/cli/test_demo_docker_compose.py
is the first coverage for this writer. It generates the stack through the writer,
parses the compose file with yaml.safe_load, and asserts the app service, its
port, its .env.demo env file, service_healthy dependencies, the mssql
profile on manufacturing_history, and that nothing outside that profile depends
on it. Written first: 5 of the 6 failed against the old template
(KeyError: 'app', KeyError: 'profiles').

Unit: 225 passed, 1 skipped, 47 deselected before; 231 passed, 1 skipped,
47 deselected after. Key-free integration: 28 passed, unchanged. Both suites run
twice under pytest-randomly.

Compose validation

Validated with a real docker compose config run (Docker 28.0.4) against
generated output; no images pulled, nothing started.

Default (docker compose -f docker-compose.demo.yml config --services):

manufacturing_ops
manufacturing_ref
manufacturing_supply
app

With --profile mssql:

manufacturing_history
manufacturing_ops
manufacturing_ref
manufacturing_supply
app

Both resolve cleanly. app's depends_on resolves to service_healthy on the
three database services and nothing references manufacturing_history outside
the profile.

Known gap, not addressed here

configs/datasources.demo.yaml for the docker demo points every datasource at
localhost:<published port>, which is correct from the host but does not resolve
from inside the app container. The compose stack starts as specified, but a
query issued against the containerised API would not reach the databases until
that config grows a container-side host. Changing it would break the documented
host-side nl2sql --env demo index / run workflow, so it is left for a
follow-up decision rather than changed here.

[nadeem4]

Task 13 of the 14-task plan.

nl2sql setup --demo --docker generated a compose file with four database
services and no application, so the demo could not actually answer a query
without the user installing and wiring up nl2sql by hand. MSSQL also forced a
~1.6 GB pull before anything came up.

What changed

• DOCKER_COMPOSE_TEMPLATE gains an app service: built from the repo root
  (context: .., dockerfile: packages/api/Dockerfile), publishes 8000:8000,
  reads the same .env.demo the lite path writes (env_file: ../.env.demo),
  mounts ../configs and ../data, and waits on the three databases with
  condition: service_healthy (all three declare healthchecks;
  manufacturing_history does not, and nothing depends on it).
• manufacturing_history is now behind profiles: ["mssql"]. Nothing outside
  the profile depends on it, so the default up never resolves it.
• DemoManager.setup_docker now always writes .env.demo, instead of behind a
  prompt: the app service's env_file must exist or Compose refuses to start
  (and docker compose config fails). The corresponding confirm prompt in
  setup_command is gone; the next-steps panel documents the API port and the
  --profile mssql opt-in.
• packages/api/Dockerfile now builds from the repo instead of PyPI. It
  installed nl2sql and nl2sql-api from PyPI, where nothing is published yet,
  so it could not build at all. It now copies packages/adapter-sdk,
  packages/nl2sql and packages/api from the build context and installs
  ./packages/adapter-sdk, ./packages/nl2sql[postgres,mysql] and
  ./packages/api. The NL2SQL_EXTRAS build arg is gone; the extras are in the
  install line.
• .gitignore gains demo_docker/ — stated explicitly rather than quietly: the
  directory setup --demo --docker generates was not ignored, and it contains
  generated database passwords.

Tests

No docker-writer tests existed before this PR. Nothing under
packages/nl2sql/tests/ referenced DockerWriter, write_docker, or
docker-compose.demo, so packages/nl2sql/tests/cli/test_demo_docker_compose.py
is the first coverage for this writer. It generates the stack through the writer,
parses the compose file with yaml.safe_load, and asserts the app service, its
port, its .env.demo env file, service_healthy dependencies, the mssql
profile on manufacturing_history, and that nothing outside that profile depends
on it. Written first: 5 of the 6 failed against the old template
(KeyError: 'app', KeyError: 'profiles').

Unit: 225 passed, 1 skipped, 47 deselected before; 231 passed, 1 skipped,
47 deselected after. Key-free integration: 28 passed, unchanged. Both suites run
twice under pytest-randomly.

Compose validation

Validated with a real docker compose config run (Docker 28.0.4) against
generated output; no images pulled, nothing started.

Default (docker compose -f docker-compose.demo.yml config --services):

manufacturing_ops
manufacturing_ref
manufacturing_supply
app

With --profile mssql:

manufacturing_history
manufacturing_ops
manufacturing_ref
manufacturing_supply
app

Both resolve cleanly. app's depends_on resolves to service_healthy on the
three database services and nothing references manufacturing_history outside
the profile.

Known gap, not addressed here

configs/datasources.demo.yaml for the docker demo points every datasource at
localhost:<published port>, which is correct from the host but does not resolve
from inside the app container. The compose stack starts as specified, but a
query issued against the containerised API would not reach the databases until
that config grows a container-side host. Changing it would break the documented
host-side nl2sql --env demo index / run workflow, so it is left for a
follow-up decision rather than changed here.

[nadeem4]

Task 13 of the 14-task plan.

nl2sql setup --demo --docker generated a compose file with four database
services and no application, so the demo could not actually answer a query
without the user installing and wiring up nl2sql by hand. MSSQL also forced a
~1.6 GB pull before anything came up.

What changed

• DOCKER_COMPOSE_TEMPLATE gains an app service: built from the repo root
  (context: .., dockerfile: packages/api/Dockerfile), publishes 8000:8000,
  reads the same .env.demo the lite path writes (env_file: ../.env.demo),
  mounts ../configs and ../data, and waits on the three databases with
  condition: service_healthy (all three declare healthchecks;
  manufacturing_history does not, and nothing depends on it).
• manufacturing_history is now behind profiles: ["mssql"]. Nothing outside
  the profile depends on it, so the default up never resolves it.
• DemoManager.setup_docker now always writes .env.demo, instead of behind a
  prompt: the app service's env_file must exist or Compose refuses to start
  (and docker compose config fails). The corresponding confirm prompt in
  setup_command is gone; the next-steps panel documents the API port and the
  --profile mssql opt-in.
• packages/api/Dockerfile now builds from the repo instead of PyPI. It
  installed nl2sql and nl2sql-api from PyPI, where nothing is published yet,
  so it could not build at all. It now copies packages/adapter-sdk,
  packages/nl2sql and packages/api from the build context and installs
  ./packages/adapter-sdk, ./packages/nl2sql[postgres,mysql] and
  ./packages/api. The NL2SQL_EXTRAS build arg is gone; the extras are in the
  install line.
• .gitignore gains demo_docker/ — stated explicitly rather than quietly: the
  directory setup --demo --docker generates was not ignored, and it contains
  generated database passwords.

Tests

No docker-writer tests existed before this PR. Nothing under
packages/nl2sql/tests/ referenced DockerWriter, write_docker, or
docker-compose.demo, so packages/nl2sql/tests/cli/test_demo_docker_compose.py
is the first coverage for this writer. It generates the stack through the writer,
parses the compose file with yaml.safe_load, and asserts the app service, its
port, its .env.demo env file, service_healthy dependencies, the mssql
profile on manufacturing_history, and that nothing outside that profile depends
on it. Written first: 5 of the 6 failed against the old template
(KeyError: 'app', KeyError: 'profiles').

Unit: 225 passed, 1 skipped, 47 deselected before; 231 passed, 1 skipped,
47 deselected after. Key-free integration: 28 passed, unchanged. Both suites run
twice under pytest-randomly.

Compose validation

Validated with a real docker compose config run (Docker 28.0.4) against
generated output; no images pulled, nothing started.

Default (docker compose -f docker-compose.demo.yml config --services):

manufacturing_ops
manufacturing_ref
manufacturing_supply
app

With --profile mssql:

manufacturing_history
manufacturing_ops
manufacturing_ref
manufacturing_supply
app

Both resolve cleanly. app's depends_on resolves to service_healthy on the
three database services and nothing references manufacturing_history outside
the profile.

Known gap, not addressed here

configs/datasources.demo.yaml for the docker demo points every datasource at
localhost:<published port>, which is correct from the host but does not resolve
from inside the app container. The compose stack starts as specified, but a
query issued against the containerised API would not reach the databases until
that config grows a container-side host. Changing it would break the documented
host-side nl2sql --env demo index / run workflow, so it is left for a
follow-up decision rather than changed here.