feat: split bootstrap into configure/migrate/up commands

[BKJN1]

The three steps bootstrap always ran together are now available individually. Needed for deploying to the VPS: "change the database schema" should be a decision someone makes on purpose, not a side effect of starting a service.

configure — machine checks, config generation via versola-tools, secret resolution against OpenBao. Starts nothing, touches no database.
migrate — applies each service's own migrations (central/auth/edge each own their schema) in throwaway containers with MIGRATE_ONLY=true (see companion PR). No server starts. --no-deps matters here: without it, auth/edge would pull central up as a full server and the point of an independent step would be lost.
up — starts the stack and waits until it's actually serving. Assumes migrate already ran; services validate their schema at startup and refuse to start against an out-of-date one.

bootstrap is unchanged from the outside — it just chains the three, asking for vps confirmation once up front rather than three times.

Also closed: configure vps now asks for confirmation too. It looks like the harmless step (it starts nothing), but its Finalize is irreversible — it overwrites state.json and deletes the previous bundle, and on vps that record is the only handle status/down/uninstall have on the live deployment. Without a prompt, running configure directly would have been a way around the exact guard #7 asked for.

Smaller things: MigratedAt is no longer a dead field (shown in status, warned about in up), orphaned migrate containers from an interrupted run are cleaned up before retrying, README documents the new commands.

Verified end-to-end on docker-local, including admin console login.

[augmentcode]

🤖 Augment PR Summary

Summary: This PR splits the deployment workflow into explicit configuration, migration, and startup phases.

• Adds configure <target> <version> to validate prerequisites and generate deployment bundles.
• Adds migrate to run central, auth, and edge migrations in one-off Compose containers.
• Adds up to start the prepared stack and wait for readiness.
• Updates bootstrap to chain the three deployment functions for backwards-compatible one-command deployments.
• Adds VPS confirmation prompts tailored to configure, migrate, and up when they run independently.
• Records successful migration time in persisted deployment state and displays it in status.
• Adds cleanup for named migration containers left after interrupted runs.
• Adds a quiet Docker wrapper for expected cleanup failures.
• Updates startup messaging to warn when no migration has been recorded.
• Registers the commands in Cobra and documents the new operational workflow in the README.
• The migration phase uses MIGRATE_ONLY=true and --no-deps to avoid starting application dependencies.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

configure does start OpenBao when the target's container is not already running (deploy.Configure runs docker compose ... up -d openbao), so this promise is inaccurate for a fresh deployment. That is particularly misleading for the new workflow's intended boundary between preparation and starting services. Other locations where this applies: README.md:178.

Severity: low

Other Locations

• README.md:178

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[BKJN1]

augment review

[augmentcode]

Sorry, Augment failed to review this pull request.