feat(helm): pre-install/pre-upgrade migration Job

Helm hook runs migrate (and optionally seed) before any pod rolls.
If the Job fails, helm upgrade aborts and the previous ReplicaSet
keeps serving traffic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

helm/ezscale-website/templates/job-migrate.yaml

@@ -0,0 +1,44 @@
+{{- if .Values.migrate.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "ezscale-website.fullname" . }}-migrate
+  labels:
+    {{- include "ezscale-website.labels" . | nindent 4 }}
+    app.kubernetes.io/component: migrate
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "0"
+    "helm.sh/hook-delete-policy": before-hook-creation
+spec:
+  backoffLimit: 1
+  ttlSecondsAfterFinished: 3600
+  template:
+    metadata:
+      labels:
+        {{- include "ezscale-website.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: migrate
+    spec:
+      restartPolicy: Never
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: migrate
+          image: {{ include "ezscale-website.image" (dict "ctx" . "role" "app") }}
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              php artisan migrate --force --no-interaction
+              {{- if .Values.migrate.seed }}
+              php artisan db:seed --class={{ .Values.migrate.seedClass }} --force --no-interaction
+              {{- end }}
+          envFrom:
+            - configMapRef:
+                name: {{ include "ezscale-website.fullname" . }}-env
+            - secretRef:
+                name: {{ include "ezscale-website.secretName" . }}
+{{- end }}