fix: M-AI-03 CI — add Redis auth + migration baseline step

Two fixes for the M-AI-03 Gate E2E job:

1. Redis: Replace REDIS_URL without password with REDIS_HOST+PORT+PASSWORD
   using secrets.REDIS_PASSWORD. The RedisService checks redis.url first;
   when REDIS_URL is set without auth, it connects but fails on AUTH.
   Using individual vars allows the password to be picked up.

2. DB: Add migration baseline step (matching current-integration pattern)
   before prisma migrate deploy. Without baselining, tables like
   UserAiSettings, ModelRoute, AiUsageLog are missing.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -312,6 +312,17 @@ jobs:
       - name: Apply database migrations
         run: |
           cd $WORKDIR
+          HAS_MIGS=$(npx prisma db execute --stdin <<< "SELECT COUNT(*) as cnt FROM _prisma_migrations" 2>/dev/null | grep -o '[0-9]*' | head -1 || echo "0")
+          if [ "$HAS_MIGS" = "0" ] || [ -z "$HAS_MIGS" ]; then
+            echo "[M-AI-03] Baselining existing migrations..."
+            for m in prisma/migrations/*/; do
+              m_name=$(basename "$m")
+              if [ "$m_name" != "backfill_chat_scope.sql" ] && [ "$m_name" != "migration_lock.toml" ]; then
+                DATABASE_URL="${{ secrets.DATABASE_URL }}" npx prisma migrate resolve --applied "$m_name" 2>/dev/null || true
+              fi
+            done
+            echo "[M-AI-03] Baseline complete."
+          fi
           DATABASE_URL="${{ secrets.DATABASE_URL }}" npx prisma migrate deploy
         timeout-minutes: 5
 
@@ -321,7 +332,10 @@ jobs:
           REQUIRE_REAL_INFRA=true \
           NODE_ENV=test AI_JOB_SYNTHETIC_ENABLED=true \
           DATABASE_URL="${{ secrets.DATABASE_URL }}" \
-          REDIS_URL="redis://127.0.0.1:6379" \
+          REDIS_HOST=127.0.0.1 \
+          REDIS_PORT=6379 \
+          REDIS_PASSWORD="${{ secrets.REDIS_PASSWORD }}" \
+          JWT_SECRET=test-jwt-secret \
           npx jest --config test/jest-m-ai-03.json --testPathPatterns="m-ai-03-gate" --forceExit --verbose
         timeout-minutes: 10