Reorder boot: bootstrap before schema-apply (and harden schema-apply)

Second CI dry-run failure exposed two more issues:

1. Schema-apply runs against a fresh Postgres → fails with "Directus
   isn't installed on this database. Please run 'directus bootstrap'
   first."  Bootstrap is what creates Directus's system tables; schema
   apply requires those tables to exist.  Local dev never tripped this
   because bootstrap had been done in earlier sessions.

2. `node cli.js schema apply` printed an ERROR but exited 0 in the
   not-installed case.  schema-apply.sh trusted the exit code,
   reported "schema apply complete," and the chain continued — until
   the post-schema migration tried to ALTER TABLE on user tables that
   never got created.

Fixes:

- entrypoint.sh: reorder steps from
    pre-schema → schema-apply → post-schema → bootstrap → start
  to
    pre-schema → bootstrap → schema-apply → post-schema → start
  Bootstrap is idempotent ("Database already initialized, skipping
  install" on warm DB) so adding it earlier costs nothing on warm
  boots and unblocks fresh boots.

- .gitea/workflows/build.yml: dry-run chain updated to mirror the new
  entrypoint order. Bootstrap is now part of the pre-boot validation,
  not skipped for speed. CI dry-run now genuinely covers the same path
  the production entrypoint takes (minus the final pm2-runtime step,
  which doesn't add validation value).

- scripts/schema-apply.sh: defense in depth. After the apply call
  succeeds (exit 0), grep the output for ' ERROR: ' and fail loudly if
  found. Catches the silent-failure pattern Directus's CLI exhibits
  when bootstrap hasn't run. Error message names the likely cause
  (schema-apply before bootstrap) for fast operator triage.

This is the second Phase 1 architectural correction exposed by the CI
dry-run gate. The gate is paying for itself in the very first PR it
runs against.

.gitea/workflows/build.yml

@@ -68,12 +68,18 @@ jobs:
       # -------------------------------------------------------------------------
       # Dry-run boot — the gate that protects the registry from broken images.
       #
-      # Runs the pre-boot script chain (apply-db-init.sh → schema-apply.sh →
-      # apply-db-init.sh against db-init-post) against the throwaway Postgres
-      # service above.  Mirrors the entrypoint's first three steps.
-      # Intentionally does NOT run `directus bootstrap` or `directus start` —
-      # that would require waiting for the HTTP server to come up, which adds
-      # minutes and tests nothing new.
+      # Runs the entrypoint's first FOUR steps against the throwaway Postgres:
+      #   pre-schema db-init → bootstrap → schema-apply → post-schema db-init
+      #
+      # Bootstrap is required: schema-apply fails on a fresh DB with
+      # "Directus isn't installed on this database" if bootstrap hasn't created
+      # Directus's system tables first. The `directus schema apply` CLI prints
+      # an ERROR but exits 0 in that case, so an earlier "skip bootstrap for
+      # speed" version of this dry-run silently masked snapshot apply failures.
+      #
+      # Step 5 (`pm2-runtime start`) is intentionally skipped — that would
+      # require waiting for the HTTP server to come up, which adds minutes and
+      # tests nothing new beyond what the prior steps already validated.
       #
       # --network host: the service container is mapped on 127.0.0.1:5432; the
       # docker run container sees it as localhost:5432 only when host networking
@@ -110,7 +116,7 @@ jobs:
             -e ADMIN_PASSWORD=ci-password-not-secret \
             -e PUBLIC_URL=http://localhost:8055 \
             trm-directus:ci \
-            -c '/directus/scripts/apply-db-init.sh && /directus/scripts/schema-apply.sh && DB_INIT_DIR=/directus/db-init-post /directus/scripts/apply-db-init.sh && echo "dry-run ok"'
+            -c '/directus/scripts/apply-db-init.sh && node /directus/cli.js bootstrap && /directus/scripts/schema-apply.sh && DB_INIT_DIR=/directus/db-init-post /directus/scripts/apply-db-init.sh && echo "dry-run ok"'
 
       # -------------------------------------------------------------------------
       # Registry login — runs only if the dry-run succeeded (default: workflow