Reorder boot: bootstrap before schema-apply (and harden schema-apply)

Second CI dry-run failure exposed two more issues:

1. Schema-apply runs against a fresh Postgres → fails with "Directus
   isn't installed on this database. Please run 'directus bootstrap'
   first."  Bootstrap is what creates Directus's system tables; schema
   apply requires those tables to exist.  Local dev never tripped this
   because bootstrap had been done in earlier sessions.

2. `node cli.js schema apply` printed an ERROR but exited 0 in the
   not-installed case.  schema-apply.sh trusted the exit code,
   reported "schema apply complete," and the chain continued — until
   the post-schema migration tried to ALTER TABLE on user tables that
   never got created.

Fixes:

- entrypoint.sh: reorder steps from
    pre-schema → schema-apply → post-schema → bootstrap → start
  to
    pre-schema → bootstrap → schema-apply → post-schema → start
  Bootstrap is idempotent ("Database already initialized, skipping
  install" on warm DB) so adding it earlier costs nothing on warm
  boots and unblocks fresh boots.

- .gitea/workflows/build.yml: dry-run chain updated to mirror the new
  entrypoint order. Bootstrap is now part of the pre-boot validation,
  not skipped for speed. CI dry-run now genuinely covers the same path
  the production entrypoint takes (minus the final pm2-runtime step,
  which doesn't add validation value).

- scripts/schema-apply.sh: defense in depth. After the apply call
  succeeds (exit 0), grep the output for ' ERROR: ' and fail loudly if
  found. Catches the silent-failure pattern Directus's CLI exhibits
  when bootstrap hasn't run. Error message names the likely cause
  (schema-apply before bootstrap) for fast operator triage.

This is the second Phase 1 architectural correction exposed by the CI
dry-run gate. The gate is paying for itself in the very first PR it
runs against.

scripts/schema-apply.sh

@@ -151,4 +151,16 @@ if [[ "${apply_exit}" -ne 0 ]]; then
   exit 1
 fi
 
+# Defense in depth: directus CLI's `schema apply` has been observed to log
+# ERROR-level messages (e.g. "Directus isn't installed on this database. Please
+# run \"directus bootstrap\" first.") while still exiting 0. Treat any line
+# containing ' ERROR: ' (with the leading space and trailing colon — Directus's
+# pino-formatted error pattern) as a fatal signal even if the CLI exited cleanly.
+if grep -qE ' ERROR: ' <<< "${apply_output}"; then
+  log_error "directus schema apply logged ERROR-level output (CLI exited 0 but failed silently)"
+  log_error "Common cause: schema apply ran before directus bootstrap on a fresh DB."
+  log_error "Operator action: ensure entrypoint runs 'directus bootstrap' BEFORE schema-apply."
+  exit 1
+fi
+
 log_info "schema apply complete"