core: bind a raw-TCP service as <name>.<domain>:<port>

A `{ref, bind}` to a TCP-exposed deployment (e.g. postgres) projected
nothing, so consumers hardcoded the docker bridge IP. Project the address
it's already documented as reachable at.

docs/relationships.md

@@ -53,6 +53,8 @@ requires:
 
 `path` is appended to the bound URL, for a consumer that wants a sub-path as its
 base (e.g. `{ ref: vllm, bind: VLLM_API_BASE, path: /v1 }`).
+A raw-TCP target (`expose.tcp`, e.g. postgres) has no URL scheme, so it binds as
+`<name>.<domain>:<port>`.
 
 A **program**'s host-package preconditions stay on the program as
 `system_dependencies` (a plain list of package names); the model synthesizes the