fix(12-05): bump version to 0.2.1 and update docs for migration-gated startup

- backend/main.py, frontend/package.json: version 0.2.0 → 0.2.1
- CLAUDE.md, AGENTS.md: current state updated to reflect gap-closure
- README.md: startup instructions note migrate runs automatically; update migration commands
- RUNBOOK.md: startup diagram includes migrate service; migration gate explanation
- SECURITY.md: Phase 12 gap-closure threat register and security gate evidence

SECURITY.md

@@ -385,3 +385,35 @@ None. Phase 12 adds a read-only cloud browse surface (no MinIO writes, no quota
 |---------|-----------|---------------|-----------|
 | T-12-SC | pip-audit tooling | pip-audit not installed in local Python 3.9 environment | No new Python packages added in Phase 12; existing packages audited in Phase 8. Operator should run pip-audit in CI or with Python 3.12 target environment. |
 | T-12-disabled | DISABLED connection returns 200 with unavailable capabilities | Browse endpoint is accessible but all operations are unavailable | This is correct behavior: ownership is still asserted (user owns the connection), and capabilities convey the unavailability. No cloud bytes or credentials are served. |
+
+---
+
+## Phase 12 Gap Closure — Schema Drift Fix (2026-06-20)
+
+### Gap Closure Threat Register
+
+| Threat ID | Threat | Disposition | Status | Evidence |
+|-----------|--------|-------------|--------|----------|
+| T-12-05-01 | App starts against stale schema (UndefinedColumn) | mitigate | CLOSED | `docker-compose.yml` migrate service + `service_completed_successfully` dependency gate; `backend/tests/test_compose_migrations.py` — 7 static assertions |
+| T-12-05-02 | DDL privilege escalation (app uses migrate URL) | mitigate | CLOSED | migrate service sets only `DATABASE_MIGRATE_URL`; backend/worker/beat receive only `DATABASE_URL`; test assertions in `test_compose_migrations.py:test_migrate_service_uses_migrate_url` |
+| T-12-05-03 | Concurrent migrations (multiple replicas upgrading) | mitigate | CLOSED | Exactly one migrate service; replicas only wait on `service_completed_successfully` — never run Alembic themselves |
+| T-12-05-04 | Secrets in Compose config or test output | mitigate | CLOSED | Environment references via `${VAR}` only; no rendered values in source or committed output |
+| T-12-05-05 | Integration test destroys developer database | mitigate | CLOSED | `test_migration_0006.py` skips without `INTEGRATION=1`/`INTEGRATION_DATABASE_URL`; explicit skip message; never touches `DATABASE_URL` |
+
+### Gap Closure Security Gate Evidence
+
+**Gate 1 — Compose configuration invariants:**
+```
+pytest -q backend/tests/test_compose_migrations.py
+7 passed
+```
+
+**Gate 2 — Migration regression tests:**
+```
+pytest -q backend/tests/test_migration_0006.py
+12 skipped (INTEGRATION not set — correct behavior without disposable DB)
+```
+Integration tests activate with `INTEGRATION=1` against a disposable PostgreSQL database.
+
+**Gate 3 — No new Python or frontend packages introduced.**
+**Gate 4 — No hardcoded credentials in Compose or test files.**