build(security): add migration and CI security gates

docker-compose.yml

@@ -13,6 +13,11 @@ services:
       - "127.0.0.1:5432:5432"
     volumes:
       - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
 
   minio:
     image: ${MINIO_IMAGE:?MINIO_IMAGE must be a pinned MinIO version or digest}
@@ -41,9 +46,11 @@ services:
       MINIO_BUCKET: qiji-photos
       MINIO_SECURE: "false"
     depends_on:
-      - postgres
-      - minio
-    command: uvicorn app.main:app --host 0.0.0.0 --port 8000
+      postgres:
+        condition: service_healthy
+      minio:
+        condition: service_started
+    command: sh -c "alembic upgrade head && exec uvicorn app.main:app --host 0.0.0.0 --port 8000"
 
 volumes:
   pgdata: