fix(deploy): validate session migrator TLS mode

docker/session-migrate.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# One-shot schema migration only. Validate TLS before reading a secret or composing a URL.
+set -eu
+
+case "${THT_SESSION_DB_SSLMODE:-}" in
+  verify-ca|verify-full) ;;
+  *)
+    echo "THT_SESSION_DB_SSLMODE must be verify-ca or verify-full" >&2
+    exit 2
+    ;;
+esac
+
+require_env() {
+  eval "value=\${$1:-}"
+  if [ -z "$value" ]; then
+    echo "missing required session migrator configuration" >&2
+    exit 2
+  fi
+}
+
+require_env THT_SESSION_DB_HOST
+require_env THT_SESSION_DB_PORT
+require_env THT_SESSION_DB_NAME
+require_env THT_SESSION_MIGRATOR_USER
+require_env THT_SESSION_MIGRATOR_PASSWORD_FILE
+require_env THT_SESSION_DB_SSLROOTCERT
+
+if [ ! -r "$THT_SESSION_MIGRATOR_PASSWORD_FILE" ]; then
+  echo "session migrator credential is unavailable" >&2
+  exit 2
+fi
+export PGPASSWORD="$(cat "$THT_SESSION_MIGRATOR_PASSWORD_FILE")"
+if [ -z "$PGPASSWORD" ]; then
+  echo "session migrator credential is unavailable" >&2
+  exit 2
+fi
+
+exec "${THT_BIN:-/opt/venv/bin/tht}" session migrate --database-url \
+  "postgresql+psycopg2://${THT_SESSION_MIGRATOR_USER}@${THT_SESSION_DB_HOST}:${THT_SESSION_DB_PORT}/${THT_SESSION_DB_NAME}?sslmode=${THT_SESSION_DB_SSLMODE}&sslrootcert=${THT_SESSION_DB_SSLROOTCERT}" \
+  --json