Run migrations at deploy time instead of push at container boot

The backend Dockerfile CMD currently runs drizzle-kit push against the live database every time the container starts. Push is a dev tool that diffs and applies whatever it thinks is needed, it can drop data on ambiguous changes, and it runs invisibly on every boot and restart.

• Remove push from the container CMD, the app just starts
• Repoint the existing RUN_MIGRATIONS stage in the Jenkinsfile at drizzle-kit migrate so schema changes are an explicit, visible deploy step that fails the deploy loudly if a migration fails
• Update the Makefile/README dev flow: db:push stays fine for local iteration, but the path to prod is generate -> commit -> deploy