Split db-init into pre-schema and post-schema phases

CI dry-run revealed an architectural ordering bug: db-init/004 and
db-init/005 ALTER TABLE the Directus-managed tables (organization_users,
events, etc.), but db-init runs BEFORE schema-apply creates those
tables. On a fresh CI Postgres this fails with "relation does not
exist." Local dev never tripped this because we'd created the tables
via MCP first.

Fix: introduce a post-schema migration phase. Two db-init runs in the
entrypoint, with schema-apply in between:

  1. apply-db-init.sh   db-init/        → positions hypertable + faulty
                                          column (tables Directus does
                                          NOT manage)
  2. schema-apply.sh                    → creates Directus-managed tables
                                          from snapshots/schema.yaml
  3. apply-db-init.sh   db-init-post/   → composite UNIQUE constraints on
                                          the Directus-managed tables
  4. directus bootstrap
  5. directus start

Files moved:
  db-init/004_junction_unique_constraints.sql →
    db-init-post/001_junction_unique_constraints.sql
  db-init/005_event_participation_unique_constraints.sql →
    db-init-post/002_event_participation_unique_constraints.sql

Each ALTER TABLE in the post-schema migrations is now wrapped in a
pg_constraint existence guard for idempotency. This handles the dev DB
where the constraints already exist (from the original 004/005 runs +
the manual psql recovery during task 1.5's destructive-apply
incident). Old 004/005 rows in migrations_applied become orphans —
harmless.

Updates:
- Dockerfile: COPY db-init-post into the image
- entrypoint.sh: 4-step → 5-step flow with the post-schema run between
  schema-apply and bootstrap
- .gitea/workflows/build.yml: dry-run chains all three pre-boot scripts
  (pre-schema → schema-apply → post-schema); path filter includes
  db-init-post/**
- Task specs 1.4 and 1.5 Done sections: updated to reference the new
  db-init-post/ path (db-init/004 → db-init-post/001, etc.)

The reusable runner script (apply-db-init.sh) didn't need to change —
it already accepts DB_INIT_DIR and uses just the basename for the
guard-table key. The two phases share migrations_applied; filenames
don't collide because pre-schema and post-schema use distinct
descriptive names.

Phase 1 is still "done" — this is a Phase 1 architectural correction
exposed by the CI dry-run, not a new task.

db-init-post/.gitkeep

@@ -0,0 +1,21 @@
+# Post-schema migrations applied AFTER directus schema apply runs.
+#
+# Pre-schema migrations live in ../db-init/ — they create tables that
+# Directus does NOT manage (positions hypertable, faulty column, future
+# PostGIS extension). Post-schema migrations live here — they constrain
+# tables that Directus DOES manage (organization_*, events, entries,
+# entry_*, classes), which are created by `directus schema apply` from
+# the snapshot YAML during entrypoint step 2/5.
+#
+# Order at boot:
+#   1. apply-db-init.sh    DB_INIT_DIR=/directus/db-init       (pre-schema)
+#   2. schema-apply.sh                                          (Directus tables created)
+#   3. apply-db-init.sh    DB_INIT_DIR=/directus/db-init-post   (post-schema)
+#   4. directus bootstrap
+#   5. directus start
+#
+# Both pre- and post- runs share the same `migrations_applied` guard
+# table. Filenames must be unique across both directories (which they
+# are by convention — pre-schema files start with descriptive names
+# from the table they create; post-schema files start with descriptive
+# names from the constraint they add).