fix(deploy): auto-run payload migrations on deploy, hide cms error details from visitors

Dockerfile

@@ -5,14 +5,12 @@ WORKDIR /app
 # Arguments for build-time configuration
 ARG NEXT_PUBLIC_BASE_URL
 ARG NEXT_PUBLIC_TARGET
-ARG DIRECTUS_URL
 ARG UMAMI_WEBSITE_ID
 ARG UMAMI_API_ENDPOINT
 
 # Environment variables for Next.js build
 ENV NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
 ENV NEXT_PUBLIC_TARGET=$NEXT_PUBLIC_TARGET
-ENV DIRECTUS_URL=$DIRECTUS_URL
 ENV UMAMI_WEBSITE_ID=$UMAMI_WEBSITE_ID
 ENV UMAMI_API_ENDPOINT=$UMAMI_API_ENDPOINT
 ENV SKIP_RUNTIME_ENV_VALIDATION=true
@@ -55,11 +53,6 @@ RUN pnpm build
 FROM git.infra.mintel.me/mmintel/runtime:latest AS runner
 WORKDIR /app
 
-# Create nextjs user and group (standardized in runtime image but ensuring local ownership)
-USER root
-RUN chown -R nextjs:nodejs /app
-USER nextjs
-
 ENV HOSTNAME="0.0.0.0"
 ENV PORT=3000
 ENV NODE_ENV=production
@@ -71,3 +64,18 @@ COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/.next/cache ./.next/cache
 
 CMD ["node", "server.js"]
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Stage: Migrator — used by CI to run "payload migrate" against the live DB.
+# Retains node_modules so the payload CLI is available.
+# ──────────────────────────────────────────────────────────────────────────────
+FROM node:20-alpine AS migrator
+WORKDIR /app
+ENV NODE_ENV=production
+
+COPY --from=builder /app/package.json ./package.json
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/src/migrations ./src/migrations
+COPY --from=builder /app/payload.config.ts ./payload.config.ts
+
+CMD ["node", "node_modules/.bin/payload", "migrate"]