fix: run Alembic migrations in entrypoint before bootstrap_admin

The entrypoint was calling init_auth_db.py → init_db() + seed_permissions()
before the FastAPI startup_event (where run_alembic_migrations() lived).
Since the _ensure_*() safety net was removed, seed_permissions() failed
with 'column roles.is_admin does not exist' on databases with old schema.

Now alembic upgrade head runs directly in the entrypoint, ensuring all
migrations are applied before any DB queries.

docker/backend.entrypoint.sh

@@ -150,6 +150,11 @@ install_playwright() {
 
 install_certificates
 install_playwright
+
+echo "[entrypoint] Running Alembic migrations..."
+alembic upgrade head 2>&1 | sed 's/^/[entrypoint]   /'
+echo "[entrypoint] ✅ Alembic migrations applied"
+
 bootstrap_admin
 
 echo "[entrypoint] Starting backend: $*"