fix(infra): supply main events secrets so ENV=main can boot

validateProductionSecrets rejected events under ENV=main without
KB/admin passwords; depends_on events healthy then blocked app forever.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.main.yml

@@ -164,7 +164,11 @@ services:
       HTTP_PORT: "${EVENTS_HTTP_PORT:-8090}"
       EVENTS_HTTP_PORT: "${EVENTS_HTTP_PORT:-8090}"
       DATA_DIR: /app/data
+      ALLOW_IN_MEMORY: "false"
+      # validateProductionSecrets(ENV=main) 需要口令；events 本身只连系统库，KB DSN 仅满足启动校验
       APP_DB_DSN: postgres://${SYSTEM_DB_USER:-app}:${SYSTEM_DB_PASSWORD:?SYSTEM_DB_PASSWORD is required for main/production}@system-db:5432/${SYSTEM_DB_NAME:-agent_system_main}?sslmode=disable
+      POSTGRES_SHARED_KB_DSN: postgres://${KB_DB_USER:-regkb}:${KB_DB_PASSWORD:?KB_DB_PASSWORD is required for main/production}@shuimu-kb-shared:5432/${KB_DB_NAME:-regulations}?sslmode=disable
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?ADMIN_PASSWORD is required for main/production}
     ports:
       - "127.0.0.1:${EVENTS_HTTP_PORT:-8090}:${EVENTS_HTTP_PORT:-8090}"
     healthcheck:
@@ -176,6 +180,7 @@ services:
     restart: always
     networks:
       - main-net
+      - shared-net
 
 networks:
   main-net: