ci: stronger db reset for e2e, volume wipe for docker-deploy

- e2e: prisma db push --force-reset claimed success but audit_logs
  ended up missing. Switch to explicit DROP SCHEMA public CASCADE via
  psql, then push, then sanity-check with to_regclass before seeding.
- docker-deploy: add docker compose down -v before starting, so the
  postgres volume is empty each run. A failed migration entry in
  _prisma_migrations from a previous run was blocking migrate deploy
  with P3009.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -351,8 +351,20 @@ jobs:
         run: pnpm --filter @capakraken/web exec playwright install-deps chromium
 
       - name: Push DB schema & seed
+        env:
+          PGPASSWORD: capakraken_test
         run: |
-          pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --force-reset --accept-data-loss --skip-generate
+          # Nuke any leftover schema state from a previous job that shared the
+          # postgres service container (act_runner reuses service volumes).
+          # --force-reset alone proved unreliable here: push reported "in sync"
+          # but audit_logs ended up missing, suggesting a split-brain between
+          # the reset and the subsequent DDL.
+          psql -h postgres -U capakraken -d capakraken_test -v ON_ERROR_STOP=1 \
+            -c "DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO capakraken; GRANT ALL ON SCHEMA public TO public;"
+          pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --accept-data-loss --skip-generate
+          # Sanity check: confirm the schema actually landed before seeding.
+          psql -h postgres -U capakraken -d capakraken_test -v ON_ERROR_STOP=1 \
+            -c "SELECT to_regclass('public.audit_logs') AS audit_logs, to_regclass('public.users') AS users;"
           pnpm db:seed
 
       - name: Run E2E tests
@@ -387,6 +399,13 @@ jobs:
           PGADMIN_PASSWORD=ci-pgadmin
           EOF
 
+      - name: Tear down any stale stack & volumes
+        # act_runner on self-hosted QNAP keeps named compose volumes between
+        # runs. A previous run's failed migration entry in _prisma_migrations
+        # causes P3009 on the next migrate deploy; wipe volumes for a truly
+        # fresh deploy test every time.
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v --remove-orphans || true
+
       - name: Start infrastructure (postgres + redis)
         run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d postgres redis