refactor: separate migrations from API runtime

compose.production.yaml

@@ -141,6 +141,7 @@ services:
       LOG_LEVEL: ${LOG_LEVEL:-INFO}
     depends_on:
       db: {condition: service_healthy}
+      migrate: {condition: service_completed_successfully}
       minio: {condition: service_healthy}
       minio-init: {condition: service_completed_successfully}
     healthcheck:
@@ -155,6 +156,23 @@ services:
       resources:
         limits: {cpus: "1.00", memory: 1G}
 
+  migrate:
+    build:
+      context: .
+      dockerfile: apps/api/Dockerfile
+    restart: "no"
+    environment:
+      DATABASE_URL: ${DATABASE_URL:?Set DATABASE_URL}
+    depends_on:
+      db: {condition: service_healthy}
+    command: ["alembic", "upgrade", "head"]
+    networks: [backend]
+    security_opt: [no-new-privileges:true]
+    logging: *default-logging
+    deploy:
+      resources:
+        limits: {cpus: "0.50", memory: 256M}
+
   web:
     build:
       context: ./apps/web