ci: Add database migration step to deploy pipeline

Migrations now run automatically before deployments:
1. Build new Docker image
2. Run migrations using the new image
3. Deploy to Kubernetes

Requires new secrets: db_host, db_port, db_name, db_user, db_pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.woodpecker/.ci.yml

@@ -163,7 +163,32 @@ steps:
       event: push
 
   # ===========================================
-  # STAGE 3: Deploy (after Docker builds)
+  # STAGE 3: Run Database Migrations (before deploy)
+  # ===========================================
+  migrate:
+    image: code.cannabrands.app/creationshop/dispensary-scraper:${CI_COMMIT_SHA:0:8}
+    environment:
+      CANNAIQ_DB_HOST:
+        from_secret: db_host
+      CANNAIQ_DB_PORT:
+        from_secret: db_port
+      CANNAIQ_DB_NAME:
+        from_secret: db_name
+      CANNAIQ_DB_USER:
+        from_secret: db_user
+      CANNAIQ_DB_PASS:
+        from_secret: db_pass
+    commands:
+      - cd /app
+      - node dist/db/migrate.js
+    depends_on:
+      - docker-backend
+    when:
+      branch: master
+      event: push
+
+  # ===========================================
+  # STAGE 4: Deploy (after migrations)
   # ===========================================
   deploy:
     image: bitnami/kubectl:latest
@@ -182,7 +207,7 @@ steps:
       - kubectl rollout status deployment/scraper -n dispensary-scraper --timeout=300s
       - kubectl rollout status deployment/cannaiq-frontend -n dispensary-scraper --timeout=120s
     depends_on:
-      - docker-backend
+      - migrate
       - docker-cannaiq
       - docker-findadispo
       - docker-findagram