Split db-init into pre-schema and post-schema phases

CI dry-run revealed an architectural ordering bug: db-init/004 and
db-init/005 ALTER TABLE the Directus-managed tables (organization_users,
events, etc.), but db-init runs BEFORE schema-apply creates those
tables. On a fresh CI Postgres this fails with "relation does not
exist." Local dev never tripped this because we'd created the tables
via MCP first.

Fix: introduce a post-schema migration phase. Two db-init runs in the
entrypoint, with schema-apply in between:

  1. apply-db-init.sh   db-init/        → positions hypertable + faulty
                                          column (tables Directus does
                                          NOT manage)
  2. schema-apply.sh                    → creates Directus-managed tables
                                          from snapshots/schema.yaml
  3. apply-db-init.sh   db-init-post/   → composite UNIQUE constraints on
                                          the Directus-managed tables
  4. directus bootstrap
  5. directus start

Files moved:
  db-init/004_junction_unique_constraints.sql →
    db-init-post/001_junction_unique_constraints.sql
  db-init/005_event_participation_unique_constraints.sql →
    db-init-post/002_event_participation_unique_constraints.sql

Each ALTER TABLE in the post-schema migrations is now wrapped in a
pg_constraint existence guard for idempotency. This handles the dev DB
where the constraints already exist (from the original 004/005 runs +
the manual psql recovery during task 1.5's destructive-apply
incident). Old 004/005 rows in migrations_applied become orphans —
harmless.

Updates:
- Dockerfile: COPY db-init-post into the image
- entrypoint.sh: 4-step → 5-step flow with the post-schema run between
  schema-apply and bootstrap
- .gitea/workflows/build.yml: dry-run chains all three pre-boot scripts
  (pre-schema → schema-apply → post-schema); path filter includes
  db-init-post/**
- Task specs 1.4 and 1.5 Done sections: updated to reference the new
  db-init-post/ path (db-init/004 → db-init-post/001, etc.)

The reusable runner script (apply-db-init.sh) didn't need to change —
it already accepts DB_INIT_DIR and uses just the basename for the
guard-table key. The two phases share migrations_applied; filenames
don't collide because pre-schema and post-schema use distinct
descriptive names.

Phase 1 is still "done" — this is a Phase 1 architectural correction
exposed by the CI dry-run, not a new task.

db-init-post/001_junction_unique_constraints.sql

@@ -0,0 +1,80 @@
+-- 001_junction_unique_constraints.sql (post-schema phase)
+-- Composite UNIQUE constraints on the org-junction tables.
+--
+-- Why post-schema?
+--   The tables this migration constrains (organization_users,
+--   organization_vehicles, organization_devices) are Directus-managed —
+--   created by `directus schema apply` from snapshots/schema.yaml during
+--   entrypoint step 2/5.  Pre-schema migrations (db-init/) cannot reference
+--   them because they don't exist yet at that point.  This file lives in
+--   db-init-post/ which the runner walks AFTER schema-apply.
+--
+-- Why composite uniqueness lives here at all (not in the snapshot YAML)?
+--   Directus's snapshot format only captures single-column unique
+--   constraints (the field-level `is_unique` flag).  Composite uniqueness
+--   is enforced via raw DDL.
+--
+-- Idempotency: each ALTER TABLE is wrapped in a `pg_constraint` existence
+--   check so the migration is safe to apply against a database where the
+--   constraints were created out-of-band (e.g. via psql during the dev
+--   recovery from the schema-apply destructive-delete incident in task
+--   1.5).  The runner's checksum guard is a separate layer; this guard
+--   protects against state drift that the runner can't see.
+
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'organization_users_org_user_unique'
+  ) THEN
+    ALTER TABLE organization_users
+      ADD CONSTRAINT organization_users_org_user_unique
+      UNIQUE (organization_id, user_id);
+  END IF;
+END $$;
+
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'organization_vehicles_org_vehicle_unique'
+  ) THEN
+    ALTER TABLE organization_vehicles
+      ADD CONSTRAINT organization_vehicles_org_vehicle_unique
+      UNIQUE (organization_id, vehicle_id);
+  END IF;
+END $$;
+
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'organization_devices_org_device_unique'
+  ) THEN
+    ALTER TABLE organization_devices
+      ADD CONSTRAINT organization_devices_org_device_unique
+      UNIQUE (organization_id, device_id);
+  END IF;
+END $$;
+
+-- -------------------------------------------------------------------------
+-- Assertion block: verify all three constraints landed.
+-- -------------------------------------------------------------------------
+DO $$ BEGIN
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'organization_users_org_user_unique'
+  ) THEN
+    RAISE EXCEPTION 'organization_users composite unique constraint missing';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'organization_vehicles_org_vehicle_unique'
+  ) THEN
+    RAISE EXCEPTION 'organization_vehicles composite unique constraint missing';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'organization_devices_org_device_unique'
+  ) THEN
+    RAISE EXCEPTION 'organization_devices composite unique constraint missing';
+  END IF;
+
+END $$;