fix(docker-dev): self-bootstrap schema via one-shot migrator (fixes fresh-volume quirks)

Adds a 'migrator' Dockerfile stage + Compose service that runs 'dotnet ef
database update' once on bring-up, so a fresh SQL volume gets the schema with no
operator step (quirk 1). cluster-seed + every host node depend on it via
service_completed_successfully, so the seed never races an in-progress migration
(quirk 2). Host build pinned to target: runtime (the migrator is now the last
stage). entrypoint + README updated; the manual 'dotnet ef' first-time step is
gone. Verified: down -v + up --build self-bootstraps (migrator+seed exit 0,
6 nodes up), deploy Sealed 6/6.

docker-dev/docker-compose.yml

@@ -70,15 +70,34 @@ services:
       timeout: 5s
       retries: 20
 
-  # ── Cluster seed (one-shot) ────────────────────────────────────────────────
-  # Waits for SQL + the host containers' EF auto-migration, then INSERTs the
-  # three ServerCluster rows and the six ClusterNode rows that scope each tenant
-  # inside the shared OtOpcUa ConfigDb. Idempotent — re-runs are no-ops.
-  cluster-seed:
-    image: mcr.microsoft.com/mssql-tools:latest
+  # ── Migrator (one-shot) ────────────────────────────────────────────────────
+  # Applies EF Core migrations to the OtOpcUa ConfigDb so a fresh SQL volume gets
+  # the schema with no operator step (the host nodes deliberately don't auto-
+  # migrate — production owns schema changes). cluster-seed + every host node
+  # depend on this completing, so nothing races an in-progress migration.
+  # Idempotent: a no-op once the schema is current.
+  migrator:
+    build:
+      context: ..
+      dockerfile: docker-dev/Dockerfile
+      target: migrator
+    image: otopcua-migrator:dev
     depends_on:
       sql:
         condition: service_healthy
+    environment:
+      OTOPCUA_CONFIG_CONNECTION: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+    restart: "no"
+
+  # ── Cluster seed (one-shot) ────────────────────────────────────────────────
+  # Runs only after `migrator` completes (so the schema is final — no race), then
+  # INSERTs the three ServerCluster rows and the six ClusterNode rows that scope
+  # each tenant inside the shared OtOpcUa ConfigDb. Idempotent — re-runs are no-ops.
+  cluster-seed:
+    image: mcr.microsoft.com/mssql-tools:latest
+    depends_on:
+      migrator:
+        condition: service_completed_successfully
     volumes:
       - ./seed:/seed:ro
     entrypoint: ["/bin/bash", "/seed/entrypoint.sh"]
@@ -100,9 +119,11 @@ services:
     build:
       context: ..
       dockerfile: docker-dev/Dockerfile
+      target: runtime
     image: otopcua-host:dev
     depends_on:
       sql: { condition: service_healthy }
+      migrator: { condition: service_completed_successfully }
     environment:
       OTOPCUA_ROLES: "admin,driver"
       ASPNETCORE_URLS: "http://+:9000"
@@ -135,6 +156,7 @@ services:
     depends_on:
       sql: { condition: service_healthy }
       central-1: { condition: service_started }
+      migrator: { condition: service_completed_successfully }
     environment:
       OTOPCUA_ROLES: "admin,driver"
       ASPNETCORE_URLS: "http://+:9000"
@@ -172,6 +194,7 @@ services:
     depends_on:
       sql: { condition: service_healthy }
       central-1: { condition: service_started }
+      migrator: { condition: service_completed_successfully }
     environment:
       OTOPCUA_ROLES: "driver"
       ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
@@ -191,6 +214,7 @@ services:
     depends_on:
       sql: { condition: service_healthy }
       central-1: { condition: service_started }
+      migrator: { condition: service_completed_successfully }
     environment:
       OTOPCUA_ROLES: "driver"
       ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
@@ -210,6 +234,7 @@ services:
     depends_on:
       sql: { condition: service_healthy }
       central-1: { condition: service_started }
+      migrator: { condition: service_completed_successfully }
     environment:
       OTOPCUA_ROLES: "driver"
       ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
@@ -227,6 +252,7 @@ services:
     depends_on:
       sql: { condition: service_healthy }
       central-1: { condition: service_started }
+      migrator: { condition: service_completed_successfully }
     environment:
       OTOPCUA_ROLES: "driver"
       ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"