feat(schema): M4.1 — tenant_registry schema + migrate binary

PLATFORM_ARCHITECTURE.md §5c schema as one initial migration: 6 tables + 4 enums + updated_at triggers. cmd/migrate binary (golang-migrate library, embedded SQL). testcontainers round-trip + seed + slug-constraint tests.

Refs: M4.1

Dockerfile

@@ -1,15 +1,20 @@
 # Multi-stage build for tenant-registry.
+# Produces two binaries:
+#   /tenant-registry  — long-running API server
+#   /migrate          — one-shot schema migrator (Orca init container in prod)
 
 FROM golang:1.24-alpine AS build
 WORKDIR /src
-COPY go.mod ./
+COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/tenant-registry ./cmd/server
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/tenant-registry ./cmd/server && \
+    CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /out/migrate         ./cmd/migrate
 
 FROM gcr.io/distroless/static-debian12:nonroot
 WORKDIR /
 COPY --from=build /out/tenant-registry /tenant-registry
+COPY --from=build /out/migrate         /migrate
 USER nonroot:nonroot
 EXPOSE 8090
 ENTRYPOINT ["/tenant-registry"]