feat(12-05): add migration-gated Compose startup path

- Add one-shot migrate service using DATABASE_MIGRATE_URL and alembic upgrade head
- Add migrate dependency (service_completed_successfully) to backend, celery-worker, celery-beat
- migrate service has same read_only/cap_drop/no-new-privileges hardening as other services
- Add test_compose_migrations.py: 7 static assertions on Compose configuration

docker-compose.yml

@@ -95,6 +95,29 @@ services:
       timeout: 3s
       retries: 5
 
+  migrate:
+    build: ./backend
+    # One-shot service: runs "alembic upgrade head" then exits 0.
+    # All application services depend on this with condition: service_completed_successfully.
+    # Uses DATABASE_MIGRATE_URL (docuvault_migrate role, DDL-capable) — not DATABASE_URL.
+    command: alembic upgrade head
+    environment:
+      - DATABASE_MIGRATE_URL=${DATABASE_MIGRATE_URL}
+      - PYTHONDONTWRITEBYTECODE=1
+    volumes:
+      - ./backend:/app
+    depends_on:
+      postgres:
+        condition: service_healthy
+    read_only: true
+    tmpfs:
+      - "/tmp:mode=1777"
+    cap_drop:
+      - ALL
+    security_opt:
+      - "no-new-privileges:true"
+    restart: "no"
+
   backend:
     build: ./backend
     ports:
@@ -135,6 +158,8 @@ services:
         condition: service_completed_successfully
       redis:
         condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
     read_only: true
     tmpfs:
       - "/tmp:mode=1777"
@@ -174,6 +199,8 @@ services:
         condition: service_completed_successfully
       redis:
         condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
     read_only: true
     tmpfs:
       - "/tmp:mode=1777"
@@ -205,6 +232,8 @@ services:
         condition: service_completed_successfully
       redis:
         condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
     read_only: true
     tmpfs:
       - "/tmp:mode=1777"