chore(deploy): automate alembic migrations across k8s and docker-compose

[AdamDiStefanoAI]

Summary

Schema migrations were a manual step ("run `alembic upgrade head` before the gateway") that's easy to forget on deploy. This PR bakes the step into both deployment surfaces so it can't be skipped.

Changes

File	Change
scripts/run-migrations.sh	New shared entrypoint. Resolves the app root, asserts `DATABASE_URL`, and runs `alembic upgrade head`. Idempotent — replicas racing each other are safe.
Dockerfile	Installs the script onto PATH as `run-migrations` so the same image services both the gateway process and the migration job without a second build.
deploy/k8s/base/gateway-deployment.yaml	Adds an `alembic-upgrade` initContainer that runs `run-migrations` before the gateway container starts. Inherits the same configmap + secret so DB URL can never drift. Same hardened securityContext (non-root, read-only root fs, all caps dropped).
docker-compose.yml	Adds a one-shot `acr-migrate` service. `acr-gateway` now waits for it via `service_completed_successfully`. `docker compose up` will always apply pending migrations before starting the gateway.

Why this works

• Idempotent. Re-running on an up-to-date schema is a no-op.
• Race-safe. Alembic wraps each migration in a transaction; the loser of a multi-replica race observes the schema as already at head and exits 0.
• Same image, no drift. Both surfaces invoke the same script baked into the runtime image, so the migration tool is always at the exact version of the deployed code.
• Belt and braces. Production already defaults to `SCHEMA_BOOTSTRAP_MODE=validate` (via `effective_schema_bootstrap_mode` in `config.py`), which makes the gateway refuse to start with a missing schema. This PR makes that failure path impossible to hit by ensuring migrations are always applied first.

Test plan

• `alembic history` shows the chain ends at `0012 (head)`
• All 28 identity tests pass
• Both YAMLs parse cleanly (compose only emits the pre-existing harmless `version:` warning)
• `docker compose up` from a clean volume completes with the gateway healthy
• `kubectl apply -k deploy/k8s/base` against a fresh cluster results in the gateway Pod becoming Ready after the initContainer exits 0

🤖 Generated with Claude Code