ci: Add migration step before deploy

Migrations now run automatically after Docker builds but before K8s deploy.
Requires DATABASE_URL secret to be configured in Woodpecker.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.woodpecker/.ci.yml

@@ -138,7 +138,25 @@ steps:
       event: push
 
   # ===========================================
-  # STAGE 3: Deploy (after all Docker builds)
+  # STAGE 3: Run Migrations (before deploy)
+  # ===========================================
+  run-migrations:
+    image: node:20
+    environment:
+      DATABASE_URL:
+        from_secret: database_url
+    commands:
+      - cd backend
+      - npm ci --prefer-offline
+      - npx tsx src/db/migrate.ts
+    depends_on:
+      - docker-backend
+    when:
+      branch: master
+      event: push
+
+  # ===========================================
+  # STAGE 4: Deploy (after migrations)
   # ===========================================
   deploy:
     image: bitnami/kubectl:latest
@@ -157,7 +175,7 @@ steps:
       - kubectl rollout status deployment/scraper -n dispensary-scraper --timeout=300s
       - kubectl rollout status deployment/cannaiq-frontend -n dispensary-scraper --timeout=120s
     depends_on:
-      - docker-backend
+      - run-migrations
       - docker-cannaiq
       - docker-findadispo
       - docker-findagram