Network Segmentation in Docker Compose

Applies when: modifying network topology, adding new services, debugging inter-service connectivity, or reviewing compose files.

Two custom bridge networks: db-net (data stores) and app-net (application tier).
db and redis: only on db-net -- not reachable from app-net-only services.
minio: on both db-net and app-net -- accessible from all services including Remotion.
api and worker: on both db-net and app-net -- can reach data stores and be reached by Remotion.
Remotion service joins cofee_backend_app-net (external network) -- can reach minio and api/worker, but NOT db or redis directly.
Remotion compose references REDIS_URL: redis://redis:6379/0 in its environment -- this will NOT resolve since redis is only on db-net. If Remotion needs Redis access, Redis must be added to app-net as well.
The old default network (cofee_backend_default) is no longer created. Any external references to it must be updated to cofee_backend_app-net.