ci: run migrations against Postgres service container in CI

Add a migrate job that applies node-pg-migrate against an ephemeral
Postgres 16 service container so broken migrations fail at PR time.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ name: CI
 # What this CI covers (and Vercel does not):
 #   - Lint (cheap belt-and-suspenders)
 #   - Schema-map drift check (docs/SCHEMA_MAP.md updated when scripts/add-*.js changes)
+#   - Migrations apply cleanly (node-pg-migrate against ephemeral Postgres 16)
 #   - Unit tests (vitest)
 #
 # NOTE: tcg-vault is JavaScript (not TypeScript). No `npx tsc --noEmit` step.
@@ -230,6 +231,36 @@ jobs:
           fi
           echo "OK: no forbidden stale strings in pages/ or components/."
 
+  migrate:
+    name: Migrations apply (node-pg-migrate)
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: deckhearth_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      POSTGRES_URL: postgres://postgres:postgres@localhost:5432/deckhearth_test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      - name: Write migrate env file
+        run: echo "POSTGRES_URL=${POSTGRES_URL}" >> .env.local
+      - run: npm run migrate up
+
   test:
     name: Unit tests (vitest)
     runs-on: ubuntu-latest