fix(migrate): fix db-migrate build and job manifest, both broken

Dockerfile.migrate copied only crates/db-migrate + a few unrelated crates
but left the root Cargo.toml's [workspace] members list referencing every
apps/* service, none of which exist in this build context - cargo failed
immediately with "failed to load manifest for workspace member apps/gateway".
Trim the workspace to just crates/db-migrate (it has no path dependency on
anything else per crates/db-migrate/Cargo.toml) using the same awk trick
Dockerfile.simple already uses per-service. Also fix the resulting binary
output path (workspace builds put target/ at the workspace root, not under
the member crate's own directory).

k8s-migration-job.yaml targeted namespace: default, where neither
nxtgauge-backend-rust-secrets nor a registry pull secret exist - both only
exist in the nxtgauge namespace where the actual app runs. Fix the namespace
and add the missing imagePullSecrets so the job can actually pull its image
and read DATABASE_URL.

Neither of these had ever been exercised successfully before - this is the
first real migration run since the job/image were added.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile.migrate

@@ -10,9 +10,19 @@ RUN rustup target add x86_64-unknown-linux-musl
 
 COPY Cargo.toml Cargo.lock ./
 COPY crates/db-migrate ./crates/db-migrate
-COPY crates/db ./crates/db
+
-COPY crates/cache ./crates/cache
+# The root Cargo.toml's [workspace] members list includes every apps/* service,
-COPY crates/email ./crates/email
+# none of which are copied into this image (db-migrate has no path dependency
+# on them - see crates/db-migrate/Cargo.toml). Restrict the workspace to just
+# this crate so cargo doesn't fail trying to resolve manifests that don't exist
+# in this build context (same trick Dockerfile.simple uses per-service).
+RUN awk '\
+  BEGIN { in_members = 0 } \
+  /^members = \[/ { print "members = [\n  \"crates/db-migrate\"\n]"; in_members = 1; next } \
+  in_members && /^\]/ { in_members = 0; next } \
+  in_members { next } \
+  { print } \
+' Cargo.toml > Cargo.toml.trimmed && mv Cargo.toml.trimmed Cargo.toml
 
 WORKDIR /app/crates/db-migrate
 ENV OPENSSL_STATIC=1
@@ -22,7 +32,7 @@ RUN cargo build --release --bin db-migrate --target x86_64-unknown-linux-musl
 FROM ci.nxtgauge.com/admin/alpine:3.20
 RUN apk add --no-cache ca-certificates libpq
 
-COPY --from=builder /app/crates/db-migrate/target/x86_64-unknown-linux-musl/release/db-migrate /usr/local/bin/
+COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/db-migrate /usr/local/bin/
 COPY crates/db/migrations /migrations
 
 ENTRYPOINT ["db-migrate"]

k8s-migration-job.yaml

@@ -2,7 +2,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: nxtgauge-db-migrate
-  namespace: default
+  namespace: nxtgauge
   labels:
     app: nxtgauge-db-migrate
 spec:
@@ -14,6 +14,8 @@ spec:
         app: nxtgauge-db-migrate
     spec:
       restartPolicy: OnFailure
+      imagePullSecrets:
+        - name: forgejo-regcred
       containers:
         - name: migrate
           image: ci.nxtgauge.com/ashwin/nxtgauge-db-migrate:high-performance-latest