feat(server): add production-safe platform-template seed job

A fresh production environment only ran migrations, so the four built-in
platform templates were never inserted unless someone manually ran
dev-seed (which also writes broad demo data). Extract the platform
template upsert into a reusable repository.EnsurePlatformTemplates and
add a standalone cmd/seed-platform-templates that calls it. Bake the
binary into the migrate image and chain it after migrate up in both
docker-compose and the k3s migration job (mounting app config so the
binary can dial the right database).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/docker-compose.yaml

@@ -156,11 +156,17 @@ services:
         condition: service_healthy
       monitoring-postgres:
         condition: service_healthy
+    environment:
+      CONFIG_PATH: /app/configs/config.yaml
+    volumes:
+      - ./config.yaml:/app/configs/config.yaml:ro
+      - ./prompts.yml:/app/configs/prompts.yml:ro
     entrypoint: >
       /bin/sh -c "
         /usr/local/bin/migrate -path /migrations -database 'postgres://geo:geo_dev@postgres:5432/geo?sslmode=disable' up &&
         /usr/local/bin/migrate -path /migrations_monitoring -database 'postgres://geo:geo_dev@monitoring-postgres:5432/geo_monitoring?sslmode=disable' up &&
-        /usr/local/bin/migrate -path /migrations_ops -database 'postgres://geo:geo_dev@postgres:5432/geo?sslmode=disable&x-migrations-table=schema_migrations_ops' up
+        /usr/local/bin/migrate -path /migrations_ops -database 'postgres://geo:geo_dev@postgres:5432/geo?sslmode=disable&x-migrations-table=schema_migrations_ops' up &&
+        /usr/local/bin/seed-platform-templates
       "
     restart: "no"
 

deploy/k3s/jobs.yaml

@@ -55,11 +55,17 @@ spec:
           image: geo-rankly/migrate:latest
           imagePullPolicy: IfNotPresent
           env:
+            - name: CONFIG_PATH
+              value: /app/configs/config.yaml
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: geo-rankly-app-secret
                   key: POSTGRES_PASSWORD
+          volumeMounts:
+            - name: app-config
+              mountPath: /app/configs
+              readOnly: true
           command:
             - /bin/sh
             - -ec
@@ -67,3 +73,20 @@ spec:
               /usr/local/bin/migrate -path /migrations -database "postgres://geo:${POSTGRES_PASSWORD}@postgres:5432/geo?sslmode=disable" up
               /usr/local/bin/migrate -path /migrations_monitoring -database "postgres://geo:${POSTGRES_PASSWORD}@monitoring-postgres:5432/geo_monitoring?sslmode=disable" up
               /usr/local/bin/migrate -path /migrations_ops -database "postgres://geo:${POSTGRES_PASSWORD}@postgres:5432/geo?sslmode=disable&x-migrations-table=schema_migrations_ops" up
+              /usr/local/bin/seed-platform-templates
+      volumes:
+        - name: app-config
+          projected:
+            sources:
+              - configMap:
+                  name: geo-rankly-app-config
+                  items:
+                    - key: config.yaml
+                      path: config.yaml
+                    - key: prompts.yml
+                      path: prompts.yml
+              - secret:
+                  name: geo-rankly-app-secret
+                  items:
+                    - key: config.local.yaml
+                      path: config.local.yaml