fix: bound connects, write on start, and tighten config checks

- Each connect attempt, including initialization, times out after 1 minute,
  and PostgreSQL DSNs without connect_timeout get connect_timeout=30, since
  lib/pq honours the context only while dialing.
- A service increments right after connecting, so a restart writes even
  when the interval outlasts the process.
- A config path that is a directory (Docker's stand-in for a missing
  bind-mount source) fails with a clear message.
- Generated service names take the first free suffix, and suffixed names
  are reserved so an explicit name cannot silently collide with them.
- counter_key inside a service's config map is rejected instead of being
  overwritten.
- Unknown keys in the config file log a warning without blocking start.
- A .dockerignore keeps local configs and .env out of the build context.

adapter/postgresql.go

@@ -3,6 +3,7 @@ package adapter
 import (
 	"context"
 	"database/sql"
+	"strings"
 
 	_ "github.com/lib/pq"
 )
@@ -14,7 +15,7 @@ func init() {
 			return nil, err
 		}
 		return &postgresAdapter{
-			url: url,
+			url: withDefaultConnectTimeout(url),
 			key: cfg.Optional("counter_key", "counter"),
 		}, nil
 	}
@@ -81,3 +82,20 @@ func (a *postgresAdapter) Close(_ context.Context) error {
 	}
 	return a.db.Close()
 }
+
+// withDefaultConnectTimeout adds connect_timeout when the DSN has none:
+// lib/pq honours the context only while dialing, so a server that accepts the
+// connection but never answers the startup handshake would hang forever.
+func withDefaultConnectTimeout(dsn string) string {
+	if strings.Contains(dsn, "connect_timeout") {
+		return dsn
+	}
+	switch {
+	case !strings.Contains(dsn, "://"):
+		return dsn + " connect_timeout=30"
+	case strings.Contains(dsn, "?"):
+		return dsn + "&connect_timeout=30"
+	default:
+		return dsn + "?connect_timeout=30"
+	}
+}