fix: legacy DB support + QA audit fixes

- Entrypoint: for legacy DBs, add is_admin via raw SQL then stamp head
  (instead of running full migration chain which fails on existing tables)
- Fixed admin_api_keys.py Pydantic config (dict → ConfigDict)
- Added tests/test_alembic_migrations.py (PostgreSQL-only integration tests)
- Fixed infinite recursion in _create_table_if_not_exists (QA catch)

docker/backend.entrypoint.sh

@@ -175,9 +175,25 @@ elif [ $_db_state -eq 1 ]; then
   alembic upgrade head 2>&1 | sed 's/^/[entrypoint]   /'
   echo "[entrypoint] ✅ Alembic initial migration applied"
 else
-  echo "[entrypoint] Legacy database — stamping Alembic head (tables already exist)..."
+  echo "[entrypoint] Legacy database — adding critical migration columns..."
+  # Add boot-critical columns that Alembic migrations would add
+  python3 -c "
+import os
+from sqlalchemy import create_engine, inspect, text
+e = create_engine(os.environ['DATABASE_URL'])
+with e.begin() as conn:
+    inspector = inspect(conn)
+    roles_cols = {c['name'] for c in inspector.get_columns('roles')}
+    if 'is_admin' not in roles_cols:
+        conn.execute(text('ALTER TABLE roles ADD COLUMN is_admin BOOLEAN NOT NULL DEFAULT FALSE'))
+        conn.execute(text(\"UPDATE roles SET is_admin = TRUE WHERE name = 'Admin'\"))
+        print('  roles.is_admin column added')
+    else:
+        print('  roles.is_admin already exists')
+"
+  echo "[entrypoint] Stamping Alembic head (tables already exist)..."
   alembic stamp head 2>&1 | sed 's/^/[entrypoint]   /'
-  echo "[entrypoint] ✅ Alembic stamped head, schema assumed up to date"
+  echo "[entrypoint] ✅ Alembic stamped head, schema ready"
 fi
 
 bootstrap_admin