feat: OpenAPI spec, task creation form, Drizzle migration workflow

- Expand OpenAPI spec from ~15 to ~40 endpoints covering all routes
  (agents, tasks, bids, ratings, payments, events, analytics, A2A,
  MCP, admin) with proper auth schemes and tags
- Add task creation page (/tasks/create) with form + Server Action
  that posts to the API with AAT auth
- Add "Create Task" button on task board
- Switch from drizzle-kit push to tracked migrations (db:generate +
  db:migrate) for production safety
- Update start.sh to run tracked migrations instead of push
- Update CLAUDE.md with new migration workflow docs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: waydelyle

CLAUDE.md

@@ -35,11 +35,18 @@ PostgreSQL 16 with pgvector. Schema defined in `packages/api/src/db/schema.ts` u
 Core tables: `agents`, `agent_skills`, `tasks`, `task_bids`, `escrow_transactions`, `agent_ratings`, `challenges`, `agent_wallets`, `anomaly_events`, `disputes`, `transactions`, `audit_log`.
 
 Drizzle commands:
-- `pnpm db:generate` — generate migration from schema changes
-- `pnpm db:push` — push schema directly (dev only)
+- `pnpm db:generate` — generate SQL migration from schema changes
+- `pnpm db:migrate` — apply pending tracked migrations
+- `pnpm db:push` — push schema directly (dev only, no migration file)
 - `pnpm db:studio` — open Drizzle Studio
 
-**IMPORTANT: Schema changes auto-deploy.** The Dockerfile runs `db:push --force` on every deploy, so any schema change pushed to `main` will be applied to production automatically. Always verify schema changes compile (`pnpm type-check`) before pushing. If you add/remove/rename columns or tables in `schema.ts`, the production DB will be updated on next deploy.
+**Schema change workflow:**
+1. Edit `packages/api/src/db/schema.ts`
+2. Run `pnpm --filter @swarmdock/api db:generate` to create a SQL migration in `packages/api/drizzle/`
+3. Review the generated SQL, then commit it alongside the schema change
+4. On deploy, `start.sh` runs the tracked migrations automatically via `db:migrate`
+
+**IMPORTANT: Migrations auto-deploy.** The Dockerfile copies `packages/api/drizzle/` into the production image and `start.sh` runs `db:migrate` on every container start. Any new migration files pushed to `main` will be applied to production on next deploy. Always verify schema changes compile (`pnpm type-check`) and review generated SQL before pushing.
 
 ## Code Conventions
 

packages/api/Dockerfile

@@ -47,13 +47,10 @@ COPY --from=build /app/packages/shared/dist/ ./packages/shared/dist/
 COPY --from=build /app/packages/api/package.json ./packages/api/package.json
 COPY --from=build /app/packages/api/dist/ ./packages/api/dist/
 
-# Copy drizzle config and startup script for db:push.
-# NOTE: schema.ts and drizzle.config.ts are TypeScript source files intentionally
-# included in the production image. start.sh runs `drizzle-kit push` on container
-# startup to apply any pending schema changes, and drizzle-kit requires the raw
-# schema definition and its config to resolve the database schema.
-COPY --from=build /app/packages/api/drizzle.config.ts ./packages/api/drizzle.config.ts
-COPY --from=build /app/packages/api/src/db/schema.ts ./packages/api/src/db/schema.ts
+# Copy tracked migrations and startup script.
+# The migrate.js entrypoint reads SQL files from drizzle/ at runtime.
+# drizzle-kit and raw TS source are no longer needed in the production image.
+COPY --from=build /app/packages/api/drizzle/ ./packages/api/drizzle/
 COPY packages/api/start.sh ./packages/api/start.sh
 
 # Copy node_modules from full install for workspace resolution
@@ -66,5 +63,5 @@ EXPOSE 3100
 
 WORKDIR /app/packages/api
 
-# Push schema changes on startup, then start server
+# Run tracked migrations on startup, then start server
 CMD ["sh", "start.sh"]

packages/api/src/db/migrate.ts

@@ -1,27 +1,39 @@
-import { execSync } from 'node:child_process';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { migrate } from 'drizzle-orm/node-postgres/migrator';
+import pg from 'pg';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 /**
  * Production migration runner.
- * Executes `drizzle-kit push` to apply schema changes to the database.
- *
- * Note: execSync is used here with a hardcoded command string (no user input),
- * so there is no command injection risk.
+ * Applies tracked SQL migrations from the drizzle/ folder using drizzle-orm's
+ * migrate function. Migrations are generated via `drizzle-kit generate` and
+ * tracked in `drizzle/meta/_journal.json`.
  */
-function main() {
+async function main() {
+  const connectionString =
+    process.env.DATABASE_URL ?? 'postgresql://swarmdock:swarmdock@localhost:5432/swarmdock';
+
   console.log('Running database migrations...');
 
+  const pool = new pg.Pool({ connectionString });
+  const db = drizzle(pool);
+
   try {
-    execSync('npx drizzle-kit push', {
-      stdio: 'inherit',
-      env: {
-        ...process.env,
-        NODE_ENV: process.env.NODE_ENV ?? 'production',
-      },
-    });
+    // Resolve the drizzle migrations folder relative to this file.
+    // In dev (tsx): src/db/migrate.ts -> ../../drizzle
+    // In prod (compiled): dist/db/migrate.js -> ../../drizzle
+    const migrationsFolder = path.resolve(__dirname, '..', '..', 'drizzle');
+
+    await migrate(db, { migrationsFolder });
     console.log('Migrations completed successfully.');
   } catch (error) {
     console.error('Migration failed:', error);
     process.exit(1);
+  } finally {
+    await pool.end();
   }
 }