feat: database migration drift detection in CI

Author: raizo07

.github/workflows/database.yml

@@ -46,25 +46,26 @@ jobs:
         working-directory: backend
         run: npm install
 
+      - name: Dump live schema for snapshot comparison
+        run: supabase db dump --local --schema-only -f /tmp/live-schema.sql
+
       - name: Run migration drift check against local database
         id: local-drift-check
-        # Official Supabase demo service role key — only valid for localhost:54321
         env:
-          SUPABASE_URL: http://localhost:54321
+          SUPABASE_URL: http://127.0.0.1:54321
           SUPABASE_SERVICE_ROLE_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImV4cCI6MTk4MzgxMjk5Nn0.EGIM96RAZx35lJzdJsyH-qQwv8Hdp7fsn3W0YpN81IU
+          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:54322/postgres
         run: |
-          echo "🔍 Verifying migration state against local database..."
-          node scripts/check-migration-drift.js --verify-db --env local --json > local-drift-result.json 2>&1 || true
+          echo "🔍 Verifying migration history and schema against local database..."
+          node scripts/check-migration-drift.js \
+            --verify-db \
+            --verify-schema \
+            --compare-schema supabase/schema.snapshot.sql \
+            --live-schema /tmp/live-schema.sql \
+            --env local \
+            --strict \
+            --json > local-drift-result.json
           cat local-drift-result.json
-          node -e "
-            const r = JSON.parse(require('fs').readFileSync('local-drift-result.json', 'utf8'));
-            if (!r.success) {
-              console.error('❌ Local database drift detected:');
-              (r.dbCheck?.issues || []).forEach(i => console.error('  [' + i.type + '] ' + i.message));
-              process.exit(1);
-            }
-            console.log('✅ Local database migration state matches filesystem (' + (r.dbCheck?.appliedCount ?? '?') + ' applied)');
-          "
 
       - name: Run RLS Policy Audit
         env: