core: bind a raw-TCP service as <name>.<domain>:<port>

A `{ref, bind}` to a TCP-exposed deployment (e.g. postgres) projected
nothing, so consumers hardcoded the docker bridge IP. Project the address
it's already documented as reachable at.

core/tests/test_requires_env.py

@@ -46,3 +46,18 @@ def test_bind_path_on_reference_base_url() -> None:
     consumer = _svc(requires=[{"ref": "ext", "bind": "EXT", "path": "/v1"}])
     cfg = _cfg({"ext": ref, "app": consumer})
     assert _requires_env(cfg, consumer) == {"EXT": "https://ext.example/v1"}
+
+
+def test_bind_tcp_service_projects_host_port() -> None:
+    """A raw-TCP target (e.g. postgres) binds as `<name>.<domain>:<port>`."""
+    pg = SystemdDeployment.model_validate(
+        {
+            "manager": "systemd",
+            "run": {"launcher": "command", "argv": ["x"]},
+            "expose": {"tcp": {"port": 5432}},
+            "reach": "internal",
+        }
+    )
+    consumer = _svc(requires=[{"ref": "postgres", "bind": "DB_HOST"}])
+    cfg = _cfg({"postgres": pg, "app": consumer})
+    assert _requires_env(cfg, consumer) == {"DB_HOST": "postgres.node.example:5432"}