feat(ci): run dalpuri CW-to-API sync as a k8s Job before deploy

The CW MSSQL and API Postgres addresses are internal to the cluster and
unreachable from GitHub-hosted runners, so the sync must run inside k8s.

- Add dalpuri-sync Docker stage to api/Dockerfile: installs deps,
  generates both Prisma clients, and runs dalpuri/src/sync.ts
- Add dalpuri/kubernetes/sync-job.yaml: mounts api-env-secret (which
  already contains CW_DATABASE_URL) and maps DATABASE_URL -> API_DATABASE_URL
- build-api job now also pushes optima-dalpuri-sync:TAG image
- sync-cw-to-api CI job replaced with kubectl apply/wait pattern,
  needs [build-api, build-worker], blocks deploy-api and deploy-worker

api/Dockerfile

@@ -133,4 +133,34 @@ COPY api/prisma.config.ts ./api/prisma.config.ts
 RUN chmod +x /app/api/prisma/migrate-entrypoint.sh
 
 WORKDIR /app/api
-CMD ["sh", "prisma/migrate-entrypoint.sh"]
+CMD ["sh", "prisma/migrate-entrypoint.sh"]
+
+# ---- Stage 7: Dalpuri CW-to-API sync runner ----
+FROM oven/bun:1.3.11 AS dalpuri-sync
+
+WORKDIR /app
+
+COPY package.json bun.lock ./
+COPY api/package.json ./api/package.json
+COPY dalpuri/package.json ./dalpuri/package.json
+COPY ui/package.json ./ui/package.json
+COPY patches ./patches
+
+RUN bun install --frozen-lockfile
+
+COPY dalpuri/src/ ./dalpuri/src/
+COPY dalpuri/prisma/ ./dalpuri/prisma/
+COPY dalpuri/prisma.config.ts ./dalpuri/prisma.config.ts
+
+COPY api/prisma/ ./api/prisma/
+COPY api/prisma.config.ts ./api/prisma.config.ts
+
+WORKDIR /app/dalpuri
+RUN DATABASE_URL="sqlserver://localhost:1433;database=dummy;user=dummy;password=dummy;trustServerCertificate=true" \
+    bunx prisma generate
+
+WORKDIR /app/api
+RUN DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy" bunx prisma generate
+
+WORKDIR /app/dalpuri
+CMD ["bun", "run", "src/sync.ts"]