Fix #33: adopt a Prisma migrations workflow

[TusharW4ni]

Fixes #33.

Adopts a real Prisma migrations workflow so the schema has reproducible history in version control and prod can be advanced with prisma migrate deploy — unblocking #14, #27, #28, #5.

⚠️ Human review + one manual prod step required (do NOT auto-merge)

This PR touches risk files (prisma/migrations, dockerfile, package.json) and changes the deploy process. Before/right-after merging you must run once against the live prod DB (which already has this schema from the old db push process):

DATABASE_URL="<prod db url>" npx prisma migrate resolve --applied 20260710023845_init

This marks the baseline as already-applied without re-running it, so the entrypoint's prisma migrate deploy sees the DB as up-to-date and is a no-op. Skipping this step would make migrate deploy try to CREATE tables that already exist and fail. After that one-time resolve, all future schema changes ship as new migrations applied automatically at container start.

What changed

• .gitignore — removed /prisma/migrations; added !prisma/migrations/**/*.sql to carve migration SQL out of the *.sql dump-block from Production Database Dump with Real PII and Session Tokens in Public Repo #29 (so migrations are tracked, but prod.sql-style dumps stay ignored — verified both).
• prisma/migrations/20260710023845_init/ — squashed baseline migration (all 10 tables + indexes) generated from the current prisma/schema/.
• dockerfile — final stage now also copies prisma.config.ts, installs the pinned prisma CLI (+dotenv, which the config loads) into the app root, and copies the entrypoint. CMD is now the entrypoint.
• docker-entrypoint.sh (new) — runs prisma migrate deploy (via npx --no-install, so no runtime network fetch), then exec node .output/server/index.mjs. set -e fails fast if a migration errors.
• package.json — replaced the stale prisma:reset (which regenerated an init migration) with prisma:migrate (migrate dev), prisma:deploy (migrate deploy), and a migration-aware prisma:reset (migrate reset --force). No dependency changes.
• CLAUDE.md — documented the new workflow and the .gitignore carve-out.

Verification done

• ✅ Baseline schema is byte-identical to db push: created one DB via prisma db push and one via prisma migrate deploy, diffed .schema — the 105 application-schema lines match exactly; the only delta is Prisma's own _prisma_migrations bookkeeping table (expected). This is what makes the migrate resolve --applied step safe on prod.
• ✅ Seed works against a migrate deploy DB.
• ✅ migrate deploy is idempotent — a second run reports "No pending migrations to apply", so container restarts are safe.
• ✅ Runtime path validated in isolation — a clean dir with only prisma/ + prisma.config.ts + a freshly-installed prisma CLI runs migrate deploy successfully (mirrors what the final image does).
• ✅ e2e suite green — 29 files / 111 tests; the harness still uses db push and is unaffected by the committed migrations.

Not validated here (please confirm in CI)

• 🔶 The Docker image build was not run locally (the dev sandbox has no container-registry network, so node:22-slim couldn't be pulled). The Dockerfile changes are standard COPY/RUN/CMD steps and the migrate-deploy logic they invoke is validated above, but the actual linux/arm64 image build + a container-start smoke test should be confirmed by the CI build (and ideally a staging run) before this reaches prod. Because merging main builds+pushes the prod image, consider building the image from this branch first if you want belt-and-suspenders.

Notes

• migrate deploy at container start (not CI) is deliberate: the prod DB is a runtime SQLite file (persistent volume), which CI's build environment can't reach.
• Image size grows modestly (prisma CLI + engine in the final stage) — the cost of runtime migrations.

🤖 Generated with Claude Code

[TusharW4ni]

🔀 Merge conflict resolved

Merged origin/main (which now includes #75 repo-hygiene) into this branch. Two conflicts, both resolved cleanly and validated:

• .gitignore — kept BOTH sides: Fix #34: Repo hygiene — remove build artifacts, one-off script, dead code #75's .gemini/ ignore rule AND this branch's !prisma/migrations/**/*.sql carve-out (so migration SQL stays tracked while dumps + .gemini/ stay ignored). /prisma/migrations remains un-ignored.
• server/utils/auth.ts — auto-merged correctly: Fix #34: Repo hygiene — remove build artifacts, one-off script, dead code #75's removal of the dead nodemailer import + transporter const is kept, AND the soft-delete login-block (findFirst({ email, deletedAt: null })) is preserved. No overlap.
• Fix #34: Repo hygiene — remove build artifacts, one-off script, dead code #75's file deletions (fix-rides.ts, PLAN.md, .gemini/settings.json) carried through.

Validated the merged result: pnpm test → 30 files / 116 tests passing. Branch is now mergeable.

Note: this branch now carries #33 (migrations) and #27 (soft deletes), since #79 was merged into this base branch. PRs #77 (#5) and #78 (#14) are still based on the earlier tip and will retarget to main once this merges — they may need a trivial rebase.