deploy: prod-only pipeline with Drizzle migrations; dev refresh + preview

- push to main builds, backs up prod (pg_dump 17), runs db-migrate + seeds,
  preflights and deploys; rollback = workflow_dispatch with rollback_tag
- staging workflow, promote step and migrate-*.ts / old SQL removed
- DB_URL = app role, DB_MIGRATE_URL = owner role
- scripts/db-refresh-dev.sh (prod dump -> local dev DB), scripts/preview.sh <branch>

.env.example

@@ -1,5 +1,9 @@
-# PostgreSQL connection (server only)
-DB_URL=postgresql://postgres:postgres@localhost:5432/personal_dev
+# PostgreSQL connections (server only). Never commit real passwords.
+# DB_URL: the app role (personal_app: DML only, no DDL).
+DB_URL=postgresql://personal_app:CHANGE_ME@localhost:5432/personal_dev
+# DB_MIGRATE_URL: the schema owner (personal), used only by drizzle-kit,
+# scripts/db-migrate.ts, the seed scripts and deploy backups.
+DB_MIGRATE_URL=postgresql://personal:CHANGE_ME@localhost:5432/personal_dev
 
 # Use the exact public origin, including scheme and port. Set the same value for both.
 ORIGIN=http://localhost:5173