chore(infra): simplify production database operations (#37)

## Summary

- Use the production Supabase runtime roles for both local and deployed
Workers.
- Remove orphaned release, local database, compatibility, and dead API
surfaces.
- Align Vault and Worker-role migrations with managed Supabase behavior.
- Restore the direct Cloudflare deploy plus explicit expand/contract
migration path.

## Decisions

- Runtime Workers keep distinct least-privilege database roles.
- Administrative migration credentials remain isolated in
`.env.migrate`.
- Production contractions remain a separate guarded operation after the
matching release is live.
- Vercel Git deployment is re-enabled for the web app.

## Validation

- `pnpm typecheck`
- `pnpm lint`
- `pnpm build`
- `pnpm architecture:check`
- `pnpm deadcode`
- `pnpm dev:services --dry-run`
- production pre-deploy migrations and target identity verification

## Rollout

1. Merge after `static-checks`.
2. Verify the production web revision.
3. Deploy the four Cloudflare services.
4. Verify service health.
5. Apply the guarded post-deploy contraction phase.
6. Verify production UI, console, network, and Worker logs.

Author: iamjr15

.env.example

@@ -1,21 +1,11 @@
-# Root .env.local is the only local credential file. Cloudflare and Vercel
-# receive production values directly in their dashboards; never copy this file there.
-
-# Local Postgres. Generate four distinct URL-safe passwords and keep each Worker
-# password identical to the password in only its own connection URL.
-LOCAL_POSTGRES_PASSWORD=replace_with_64_hex_postgres_password
-LOCAL_APP_GATEWAY_PASSWORD=replace_with_64_hex_app_gateway_password
-LOCAL_APP_AGENT_PASSWORD=replace_with_64_hex_app_agent_password
-LOCAL_APP_WEBHOOKS_PASSWORD=replace_with_64_hex_app_webhooks_password
-LOCAL_DATABASE_PORT=54322
-CHEATCODE_LOCAL_DATABASE=true
-SUPABASE_MIGRATION_URL=postgresql://postgres:replace_with_64_hex_postgres_password@database:5432/postgres
-SUPABASE_MIGRATION_EXPECTED_HOST=database
-SUPABASE_MIGRATION_EXPECTED_DATABASE=postgres
-SUPABASE_MIGRATION_EXPECTED_ROLE=postgres
-LOCAL_GATEWAY_DATABASE_URL=postgresql://app_gateway:replace_with_64_hex_app_gateway_password@database:5432/postgres
-LOCAL_AGENT_DATABASE_URL=postgresql://app_agent:replace_with_64_hex_app_agent_password@database:5432/postgres
-LOCAL_WEBHOOKS_DATABASE_URL=postgresql://app_webhooks:replace_with_64_hex_app_webhooks_password@database:5432/postgres
+# Root .env.local is the only local application credential file. Local Workers
+# use the production Supabase database through its public session pooler and the
+# same three least-privilege roles as production Hyperdrive. Keep each password
+# identical to the password configured on only its matching production role.
+# Administrative migration credentials belong in .env.migrate, never here.
+SUPABASE_GATEWAY_DATABASE_URL=postgresql://app_gateway.snqtclnmhcaupqynjyux:replace_with_gateway_role_password@aws-0-ap-south-1.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true
+SUPABASE_AGENT_DATABASE_URL=postgresql://app_agent.snqtclnmhcaupqynjyux:replace_with_agent_role_password@aws-0-ap-south-1.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true
+SUPABASE_WEBHOOKS_DATABASE_URL=postgresql://app_webhooks.snqtclnmhcaupqynjyux:replace_with_webhooks_role_password@aws-0-ap-south-1.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true
 
 # Clerk development instance. These test keys are for this laptop only; every
 # Vercel environment uses the production Clerk instance.

.env.migrate.example

@@ -0,0 +1,11 @@
+# Copy to .env.migrate only on an authorized operator workstation. This file
+# targets the production Supabase database and is never loaded by the app,
+# Compose, Wrangler, Next.js, or any Worker.
+SUPABASE_MIGRATION_URL=postgresql://postgres:replace_with_production_admin_password@db.snqtclnmhcaupqynjyux.supabase.co:5432/postgres?sslmode=require
+SUPABASE_MIGRATION_EXPECTED_HOST=db.snqtclnmhcaupqynjyux.supabase.co
+SUPABASE_MIGRATION_EXPECTED_DATABASE=postgres
+SUPABASE_MIGRATION_EXPECTED_ROLE=postgres
+SUPABASE_MIGRATION_EXPECTED_SYSTEM_IDENTIFIER=replace_with_pg_control_system_identifier
+
+# Optional one-time protected migration attestation envelope.
+CHEATCODE_MIGRATION_ATTESTATIONS=

.github/workflows/deploy-workers.yml

@@ -15,6 +15,7 @@ qa-*.png
 .env
 .env.*
 !.env.example
+!.env.migrate.example
 apps/*/.dev.vars
 apps/*/wrangler.local-dev.generated.jsonc
 apps/*/wrangler.production.*.generated.json

.gitignore

@@ -117,22 +117,18 @@ not write, run, or keep scripts to submit prompts, click UI, drive auth, wrap
 ## Run locally
 
 ```bash
-pnpm dev                                # Compose: Postgres + migrations + Next + chained Workers
+pnpm dev                                # Compose: Next + chained Workers against production Supabase
 pnpm dev:down                           # Stop the local Compose stack
 ```
 
 Required local env vars in `.env.local` (template in `.env.example`):
 
 ```
-# Local Postgres + per-Worker roles (distinct URL-safe passwords)
-LOCAL_POSTGRES_PASSWORD=
-LOCAL_APP_GATEWAY_PASSWORD=
-LOCAL_APP_AGENT_PASSWORD=
-LOCAL_APP_WEBHOOKS_PASSWORD=
-SUPABASE_MIGRATION_URL=postgresql://postgres:<local-password>@database:5432/postgres
-LOCAL_GATEWAY_DATABASE_URL=postgresql://app_gateway:<gateway-password>@database:5432/postgres
-LOCAL_AGENT_DATABASE_URL=postgresql://app_agent:<agent-password>@database:5432/postgres
-LOCAL_WEBHOOKS_DATABASE_URL=postgresql://app_webhooks:<webhooks-password>@database:5432/postgres
+# Production Supabase session-pooler URLs for the three isolated Worker roles.
+# Administrative migration credentials never belong in .env.local.
+SUPABASE_GATEWAY_DATABASE_URL=
+SUPABASE_AGENT_DATABASE_URL=
+SUPABASE_WEBHOOKS_DATABASE_URL=
 
 # Per-Worker signed tenant context (three distinct secrets, each at least 32 bytes)
 DATABASE_CONTEXT_SIGNING_SECRET_GATEWAY=
@@ -173,9 +169,11 @@ RELEASE_DATABASE_READINESS_SECRET=
 NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787
 ```
 
-Never commit `.env.local`. It is the sole laptop credential file and accepts only
-Clerk test keys plus sandbox/local credentials. Vercel and Cloudflare receive
-production credentials directly through their protected production environments.
+Never commit `.env.local`. It is the sole laptop application credential file;
+its database URLs contain only the three least-privilege production runtime
+roles. Vercel and Cloudflare receive production credentials directly through
+their protected production environments. Administrative migration credentials
+live only in git-ignored `.env.migrate` on authorized operator workstations.
 
 ## Code conventions (CI-enforced)