chore(deploy): wire ops-api service into docker-compose stack

Adds the ops-api container, ops-config volume, and migrate-ops step so
the operations console backend boots alongside the rest of the stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/docker-compose.yaml

@@ -158,7 +158,8 @@ services:
     entrypoint: >
       /bin/sh -c "
         /usr/local/bin/migrate -path /migrations -database 'postgres://geo:geo_dev@postgres:5432/geo?sslmode=disable' up &&
-        /usr/local/bin/migrate -path /migrations_monitoring -database 'postgres://geo:geo_dev@monitoring-postgres:5432/geo_monitoring?sslmode=disable' up
+        /usr/local/bin/migrate -path /migrations_monitoring -database 'postgres://geo:geo_dev@monitoring-postgres:5432/geo_monitoring?sslmode=disable' up &&
+        /usr/local/bin/migrate -path /migrations_ops -database 'postgres://geo:geo_dev@postgres:5432/geo?sslmode=disable&x-migrations-table=schema_migrations_ops' up
       "
     restart: "no"
 
@@ -217,6 +218,39 @@ services:
     volumes: *app-volumes
     depends_on: *app-depends
 
+  ops-api:
+    image: ${IMAGE_REGISTRY:-ghcr.io/your-org/geo-rankly}/ops-api:${IMAGE_TAG:-latest}
+    container_name: geo-ops-api
+    build:
+      context: ../server
+      dockerfile: Dockerfile
+      target: runtime
+      args:
+        SERVICE: ops-api
+    restart: unless-stopped
+    environment:
+      CONFIG_PATH: /app/configs/ops-config.yaml
+      OPS_JWT_SECRET: ${OPS_JWT_SECRET:-change-me-in-production}
+      OPS_DEFAULT_ADMIN_USERNAME: ${OPS_DEFAULT_ADMIN_USERNAME:-admin}
+      OPS_DEFAULT_ADMIN_PASSWORD: ${OPS_DEFAULT_ADMIN_PASSWORD:-}
+      OPS_DEFAULT_ADMIN_DISPLAY_NAME: ${OPS_DEFAULT_ADMIN_DISPLAY_NAME:-系统管理员}
+      OPS_DEFAULT_ADMIN_EMAIL: ${OPS_DEFAULT_ADMIN_EMAIL:-}
+    volumes:
+      - ./ops-config.yaml:/app/configs/ops-config.yaml:ro
+    depends_on:
+      postgres:
+        condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
+    ports:
+      - "${OPS_API_PORT:-8090}:8090"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8090/api/health/live || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
   # ────────────────── Frontend ─────────────────────────────────────────────────
 
   frontend: