ci(deploy): mount postgres init as a DIRECTORY (fix 'Is a directory')

The single-file bind mount ./scripts/init-db.sh left a stale empty dir in the
reused act_runner workspace → mounted as a directory → migrations never ran →
empty schemas → backend 28P01/connection failures. Move the init script to
deploy/postgres-initdb/00-init.sh and mount the whole DIR at
/docker-entrypoint-initdb.d (robust, like the migrations dir). Deploy checkout
now 'git clean -ffd' to purge stale workspace dirs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci-cd.yml

@@ -66,6 +66,9 @@ jobs:
           git config http.extraheader "Authorization: Bearer ${TOKEN}"
           git fetch --depth=1 origin "${REF}"
           git checkout -f FETCH_HEAD
+          # Remove stale Docker-created bind-mount dirs from a previous run (e.g. an
+          # empty scripts/init-db.sh dir) so they don't shadow real files. -e keeps .env.
+          git clean -ffd -e .env || true
 
       - name: Write .env (from ENV_FILE secret)
         run: printf '%s' "$ENV_FILE" > .env

deploy/postgres-initdb/00-init.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
 # FlatRender V2 — run all schema migrations in order on first postgres init.
-# Mounted at: /docker-entrypoint-initdb.d/00-init.sh
-# Migrations dir mounted at: /migrations  (read-only)
+# This whole directory is mounted at /docker-entrypoint-initdb.d (a DIRECTORY mount
+# is robust; a single-file bind mount can leave a stale empty dir in a reused CI
+# workspace → "Is a directory"). Migrations dir mounted read-only at /migrations.
 set -e
 
 MIGRATIONS_DIR="/migrations"

docker-compose.v2.yml

@@ -27,7 +27,8 @@ services:
       - pgdata:/var/lib/postgresql/data
       # migrations are run once by init-db.sh when the data volume is first created
       - ./backend/db/migrations:/migrations:ro
-      - ./scripts/init-db.sh:/docker-entrypoint-initdb.d/00-init.sh:ro
+      # Directory mount (NOT a single file) — robust against stale CI-workspace dirs.
+      - ./deploy/postgres-initdb:/docker-entrypoint-initdb.d:ro
     ports:
       # HOST_BIND=127.0.0.1 in prod keeps these off the public interface (only
       # Caddy's 80/443 face the internet). Unset → 0.0.0.0 for local/LAN dev.