fix(deploy): make 0001_init.sql re-runnable and repair historical _migrations tracking

The "Run migrations" job (and thus the whole deploy) was failing on every push after the first successful bootstrap with:

  ✗ 0001_init.sql failed: relation "admin_users" already exists

Root causes:
- 0001_init.sql used plain CREATE TABLE/INDEX/TRIGGER despite the header comment claiming "CREATE TABLE IF NOT EXISTS".
- The _migrations tracking row for 0001_init.sql was never recorded on the prod DATABASE_URL (tracking logic landed after initial apply, or apply happened outside the runner).

Fix (3 layers of defense):
* db/migrations/0001_init.sql: every CREATE TABLE now uses IF NOT EXISTS (63 tables), CREATE INDEX uses IF NOT EXISTS (49), all CREATE TRIGGER wrapped in safe DO $$ IF NOT EXISTS (pg_trigger join check) THEN ... END IF; $$, removed the file's own BEGIN/COMMIT so the runner's transaction is authoritative. RLS drop+create and CREATE OR REPLACE FUNCTION were already safe.
* scripts/migrate.js: added ensureTracked() right after loading the applied set. For 0001/0002, if the core objects (admin_users table, password_hash column) already exist in information_schema but the tracking row is absent, INSERT the filename (ON CONFLICT DO NOTHING) and log "repaired tracking". Then the normal skip path handles it.
* .gitea/workflows/deploy.yml: added an inline node -e pre-repair (same admin_users existence check → force _migrations row) immediately before `npm run migrate:one`. This protects even on an older checkout of the runner. The neon_auth preflight and post-apply "admin_users must exist" hard gate are untouched.
* Minor: cleaned 0002_admin_password.sql tx wrapper for consistency; updated MEMORY.md with the incident + resolution.

Result: deploys (and any server-side `node scripts/migrate.js` recovery runs) on an already-initialized prod DB will repair/skip 0001 cleanly, pass the verification query, and continue to build/deploy. The scp of scripts/ + db/migrations/ in the Deploy step now carries the fixed versions.

See the plan note in deploy.yml and MEMORY.md for background.

scripts/migrate.js

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 /**
  * Apply Postgres migrations from `db/migrations/*.sql` in lexical order.
- * Wraps the whole thing in a transaction; tracks applied files in
- * `_migrations` so re-runs are safe.
+ * Wraps each new file in a transaction; tracks applied files in
+ * `_migrations` so re-runs are safe and idempotent.
+ *
+ * The 0001_init.sql (and 0002) are now fully re-runnable (IF NOT EXISTS +
+ * trigger guards) + this script has repair logic for DBs that were
+ * initialized before tracking was introduced.
  *
  * Usage:
- *   npm run db:migrate
- *
- * Replaces the old `supabase/push-migrations.js` — that script was
- * hardcoded to a Supabase URL. This one reads `DATABASE_URL` directly.
+ *   npm run migrate
+ *   npm run migrate:one     # same as above (applies all pending)
  */
 require("dotenv").config({ path: ".env.local" });
 
@@ -51,6 +53,37 @@ async function main() {
     );
     const appliedSet = new Set(applied.map((r) => r.filename));
 
+    // Repair for historical DBs (applied before _migrations tracking existed,
+    // or via direct psql / earlier tooling). If the core objects are present
+    // we record the filename so future deploys (and server-side recovery runs)
+    // treat 0001/0002 as done without re-executing the large init script.
+    async function ensureTracked(filename, existenceCheckSql) {
+      if (appliedSet.has(filename)) return;
+      try {
+        const { rows } = await client.query(existenceCheckSql);
+        if (rows.length > 0) {
+          await client.query(
+            `INSERT INTO _migrations (filename) VALUES ($1) ON CONFLICT (filename) DO NOTHING`,
+            [filename]
+          );
+          console.log(`✓ ${filename} (objects present in DB; repaired tracking)`);
+          appliedSet.add(filename);
+        }
+      } catch (e) {
+        // Non-fatal: the check may fail on a brand-new DB or with limited perms.
+        // We'll let the normal apply path handle it.
+      }
+    }
+
+    await ensureTracked(
+      "0001_init.sql",
+      "SELECT 1 FROM information_schema.tables WHERE table_name = 'admin_users' LIMIT 1"
+    );
+    await ensureTracked(
+      "0002_admin_password.sql",
+      "SELECT 1 FROM information_schema.columns WHERE table_name = 'users' AND column_name = 'password_hash' LIMIT 1"
+    );
+
     let appliedNow = 0;
     for (const file of files) {
       if (appliedSet.has(file)) {