ci: fix fresh-DB bootstrap for e2e and docker-deploy

- e2e: use prisma db push --force-reset so the job starts from a
  guaranteed clean schema (previous runs hit missing audit_logs
  even though push reported in-sync; suspected stale service volume).
- docker-deploy: run prisma db push before db:migrate:deploy in
  app-dev-start.sh. The migrations/*.sql files are idempotent
  supplements (IF NOT EXISTS guards) that assume base tables already
  exist; a fresh container has no tables, so the first incremental
  migration's FK on "users" fails. db push creates the baseline,
  migrate deploy then layers on the incremental additions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -352,7 +352,7 @@ jobs:
 
       - name: Push DB schema & seed
         run: |
-          pnpm db:push
+          pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --force-reset --accept-data-loss --skip-generate
           pnpm db:seed
 
       - name: Run E2E tests

tooling/docker/app-dev-start.sh

@@ -21,7 +21,14 @@ CI=true pnpm install --frozen-lockfile
 # Regenerate Prisma client (needed after bind-mount overlays the image layer)
 pnpm --filter @capakraken/db db:generate
 
-# Run pending migrations so a fresh checkout boots against a current schema
+# Sync full schema to the DB first. The files under prisma/migrations/ are
+# idempotent SUPPLEMENTS (see "IF NOT EXISTS" guards in each migration.sql);
+# they assume the base tables already exist from a prior `db push`. On a
+# fresh DB, migrate deploy alone would fail because the first incremental
+# migration references "users" before it exists.
+pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --accept-data-loss --skip-generate
+
+# Run pending migrations so a fresh checkout picks up incremental additions
 pnpm --filter @capakraken/db db:migrate:deploy
 
 pnpm check:exports