Run migrations as a separate step, not on app startup

[lukpueh]

Switch from migrating on container startup to applying migrations as a dedicated step before rollout, so the long-lived app pods can run with a read-only database user. In production this is a Helm pre-install/pre-upgrade hook job that runs alembic upgrade head using the app image; the chart lives in eclipse-csi/helm-charts.

• Dockerfile: CMD is plain uvicorn again (no startup migration); the alembic CLI remains in the image so the hook job can override the command. Remove start.sh, which is no longer needed. (this is the important part!)
• alembic/env.py: read the DB URL straight from PIA_DATABASE_URL instead of constructing the full app Settings, so migrations only depend on the database connection (not the Dependency Track API key) and can run under a dedicated, minimally-scoped DB user. Mirrors how cli.py reads the URL.
• docker-compose.yml: keep the dev-only convenience of chaining migration with the app start, inline, documented as dev-only.
• CI: run "alembic upgrade head" as its own step (mirroring the hook) before the uvicorn smoke test, exercising both the migration scripts and app boot.
• README: document the separate-step / Helm hook migration model.