feat(deploy): auto-run db migrations + seed on stack deploy

Add a migrator Dockerfile target (drizzle-kit migrate + tier-definitions
seed, both idempotent) and wire it as a one-shot compose service that web
waits on via service_completed_successfully. No more manual exec step
after first deploy — runs safely on every redeploy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -11,6 +11,12 @@ COPY packages/db/package.json packages/db/package.json
 COPY packages/api-types/package.json packages/api-types/package.json
 RUN pnpm install --frozen-lockfile
 
+# ---- migrator: applies drizzle migrations + seeds tier definitions ----
+FROM deps AS migrator
+WORKDIR /repo/packages/db
+COPY packages/db .
+CMD ["sh", "-c", "pnpm migrate && pnpm seed"]
+
 # ---- build ----
 FROM base AS build
 WORKDIR /repo

docker/DEPLOY.md

@@ -29,14 +29,12 @@ OPENROUTER_API_KEY=
 5. Deploy the stack. Portainer builds `web` from the repo's root `Dockerfile` (see `build:` in compose.prod.yml) — no separate image push needed.
 6. Enable GitOps updates (webhook or polling) on the stack if you want redeploy-on-push.
 
-## First deploy: run migrations + seed
+## Migrations + seed
 
-Compose does not auto-migrate. After the stack is up, exec into the `web` container once (or run a one-off container against the same network) with `DATABASE_URL` set, then:
-
-```bash
-pnpm db:migrate
-pnpm db:seed   # tier definitions — first deploy only
-```
+Handled automatically. The `migrate` service builds from the `migrator` Dockerfile target,
+runs `drizzle-kit migrate` then the tier-definitions seed, and exits; `web` waits for it to
+complete successfully before starting (`depends_on: migrate: condition: service_completed_successfully`).
+Both are idempotent — safe to re-run on every stack redeploy, not just the first one.
 
 ## Traefik (separate LXC, file provider)
 

docker/compose.prod.yml

@@ -49,6 +49,18 @@ services:
         exit 0;
       "
 
+  migrate:
+    build:
+      context: ..
+      dockerfile: Dockerfile
+      target: migrator
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: "no"
+
   web:
     build:
       context: ..
@@ -73,8 +85,8 @@ services:
       # published on portainer LXC host; traefik (other LXC) routes here via <this-lxc-ip>:${WEB_PORT}
       - "${WEB_PORT:-3000}:3000"
     depends_on:
-      postgres:
-        condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
       redis:
         condition: service_started
       minio: