fix: crash loop recovery, auto-migrations, CI test pipeline

- Wrap startup syncs in safeStartup() to prevent crash on external service failure
- Add migrate-entrypoint.sh for auto-generating migrations from schema diff
- Update Dockerfile migration stage to use entrypoint script
- Add test job to build-and-publish workflow (runs before build)
- Add tests.yaml workflow to run tests on every push
- Fix test setup to use real RSA key pair instead of plain strings
- Add test script to package.json

tests/setup.ts

@@ -4,6 +4,18 @@
  */
 
 import { mock } from "bun:test";
+import crypto from "crypto";
+
+// ---------------------------------------------------------------------------
+// Generate a real RSA key pair for modules that call crypto.createPrivateKey()
+// at import time (e.g. readSecureValue.ts).
+// ---------------------------------------------------------------------------
+const { privateKey: _testPrivateKey, publicKey: _testPublicKey } =
+  crypto.generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "pem" },
+  });
 
 // ---------------------------------------------------------------------------
 // Mock the constants module — almost every source file imports from here.
@@ -17,11 +29,11 @@ mock.module("../src/constants", () => ({
   sessionDuration: 30 * 24 * 60 * 60_000,
   accessTokenDuration: "10min",
   refreshTokenDuration: "30d",
-  accessTokenPrivateKey: "mock-access-private-key",
-  refreshTokenPrivateKey: "mock-refresh-private-key",
-  permissionsPrivateKey: "mock-permissions-private-key",
-  secureValuesPrivateKey: "mock-secure-values-private-key",
-  secureValuesPublicKey: "mock-secure-values-public-key",
+  accessTokenPrivateKey: _testPrivateKey,
+  refreshTokenPrivateKey: _testPrivateKey,
+  permissionsPrivateKey: _testPrivateKey,
+  secureValuesPrivateKey: _testPrivateKey,
+  secureValuesPublicKey: _testPublicKey,
   msalClient: { acquireTokenByCode: mock(() => Promise.resolve({})) },
   connectWiseApi: {
     get: mock(() => Promise.resolve({ data: {} })),