feat: phase 6 production hardening + DB-to-DB transfer

Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
  retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
  auth middleware; scope picker + badges in Settings UI; scopeless legacy
  keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
  fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
  which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY

Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
  (migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
  to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
  against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)

Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
  target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
  verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
  (429s = configured rate limiter working)

Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -129,6 +129,86 @@ jobs:
           push: false
           tags: primora-frontend:test
 
+  migrations:
+    name: Migration Up/Down
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: primora_test
+          POSTGRES_PASSWORD: test
+          POSTGRES_DB: primora_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.26'
+          cache-dependency-path: apps/backend/go.sum
+
+      - name: Install goose
+        run: go install github.com/pressly/goose/v3/cmd/[email protected]
+
+      - name: Migrations up
+        run: |
+          goose -dir apps/backend/db/migrations \
+            postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" up
+
+      - name: Migrations reset (all downs)
+        run: |
+          goose -dir apps/backend/db/migrations \
+            postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" reset
+
+      - name: Migrations up again (idempotent re-apply)
+        run: |
+          goose -dir apps/backend/db/migrations \
+            postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" up
+
+  e2e-smoke:
+    name: Compose E2E Smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare env
+        run: cp .env.example .env
+
+      - name: Start stack
+        run: >-
+          docker compose
+          -f docker-compose.yml -f docker-compose.dev.yml
+          up -d --build
+
+      - name: Run smoke checks
+        run: ./scripts/smoke-e2e.sh
+
+      - name: Dump logs on failure
+        if: failure()
+        run: >-
+          docker compose
+          -f docker-compose.yml -f docker-compose.dev.yml
+          logs --tail=200
+
+      - name: Tear down
+        if: always()
+        run: >-
+          docker compose
+          -f docker-compose.yml -f docker-compose.dev.yml
+          down -v
+
   lint:
     name: Lint
     runs-on: ubuntu-latest