Guard deploys against a broken migration

Program.cs: wrap the boot-time MigrateAsync in try/catch (was an unhandled
exception into a restart:unless-stopped crash-loop), log critical and exit(1)
on failure, and add a --migrate-only flag that applies migrations then exits
0 without starting the web host.

deploy.sh: run migrations as a preflight via the new --migrate-only image
against the live novelly-data volume, before the running (old-image) stack
is touched. A failing migration now aborts the deploy with the old
containers still serving traffic, instead of swapping to a crash-looping
new container first and finding out from the health-check timeout.

scripts/ci/deploy.sh

@@ -19,6 +19,15 @@ COMPOSE="docker compose -f deploy/qa/docker-compose.qa.yml"
 log "Pulling latest :latest images"
 $COMPOSE pull
 
+# Applies pending migrations against the live novelly-data volume using the new image,
+# before the running (old-image) stack is touched. If a migration is broken, this fails
+# here and the old containers keep serving traffic — `down`/`up` below never runs, so
+# there is nothing to roll back.
+log "Running preflight migration check"
+if ! $COMPOSE --profile tools run --rm migrate; then
+  fail "migration failed against the new image; old novelly stack left running untouched"
+fi
+
 log "Recreating the novelly stack (data volume preserved)"
 $COMPOSE down
 $COMPOSE up -d