fix(12-05): bump version to 0.2.1 and update docs for migration-gated startup

- backend/main.py, frontend/package.json: version 0.2.0 → 0.2.1
- CLAUDE.md, AGENTS.md: current state updated to reflect gap-closure
- README.md: startup instructions note migrate runs automatically; update migration commands
- RUNBOOK.md: startup diagram includes migrate service; migration gate explanation
- SECURITY.md: Phase 12 gap-closure threat register and security gate evidence

README.md

@@ -117,16 +117,15 @@ print('JWT_PUBLIC_KEY='  + base64.b64encode(k.public_key().public_bytes(serializ
 #   (everything else has usable defaults for local dev)
 nano .env
 
-# 5. Start all services
+# 5. Start all services (migrations run automatically before backend starts)
 docker compose up -d --build
 
-# 6. Run database migrations
-docker compose exec backend alembic upgrade head
-
-# 7. Open the app
+# 6. Open the app
 open http://localhost:5173
 ```
 
+The `migrate` service runs `alembic upgrade head` automatically before the backend, Celery worker, and Celery beat start. No manual migration step is needed on a normal `docker compose up`.
+
 The bootstrap admin account (email + password from `.env`) is created automatically on first startup if no users exist.
 
 ---
@@ -222,8 +221,12 @@ npm run dev          # http://localhost:5173
 ### Database migrations
 
 ```bash
-# Apply all pending migrations
-docker compose exec backend alembic upgrade head
+# Migrations run automatically on docker compose up via the migrate service.
+# To run them manually (e.g., after a git pull without restarting):
+docker compose run --rm migrate
+
+# Check current revision
+docker compose run --rm migrate alembic current
 
 # Create a new migration after changing db/models.py
 docker compose exec backend alembic revision --autogenerate -m "describe change"