feat(ci): run dalpuri CW-to-API sync as a k8s Job before deploy

The CW MSSQL and API Postgres addresses are internal to the cluster and
unreachable from GitHub-hosted runners, so the sync must run inside k8s.

- Add dalpuri-sync Docker stage to api/Dockerfile: installs deps,
  generates both Prisma clients, and runs dalpuri/src/sync.ts
- Add dalpuri/kubernetes/sync-job.yaml: mounts api-env-secret (which
  already contains CW_DATABASE_URL) and maps DATABASE_URL -> API_DATABASE_URL
- build-api job now also pushes optima-dalpuri-sync:TAG image
- sync-cw-to-api CI job replaced with kubectl apply/wait pattern,
  needs [build-api, build-worker], blocks deploy-api and deploy-worker

dalpuri/kubernetes/sync-job.yaml

@@ -0,0 +1,31 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: dalpuri-sync-RELEASE_TAG
+  namespace: optima
+  labels:
+    app: dalpuri-sync
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 86400
+  activeDeadlineSeconds: 1800
+  template:
+    metadata:
+      labels:
+        app: dalpuri-sync
+    spec:
+      containers:
+        - name: sync
+          image: ghcr.io/horizonstacksoftware/optima-dalpuri-sync:RELEASE_TAG
+          envFrom:
+            - secretRef:
+                name: api-env-secret
+          env:
+            - name: API_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: api-env-secret
+                  key: DATABASE_URL
+      restartPolicy: Never
+      imagePullSecrets:
+        - name: github-container-registry