fix(ci): explicit env vars in dalpuri sync job; add CW_DATABASE_URL to secret

envFrom was loading api-env-secret but CW_DATABASE_URL was absent from the
deployed secret, causing sync.ts to fall back to DATABASE_URL (Postgres) as
the MSSQL connection string -> 'Invalid port number: //optima'.

- Replaced envFrom with explicit CW_DATABASE_URL and API_DATABASE_URL env
  entries so the mapping is unambiguous
- Patched api-env-secret in cluster to add CW_DATABASE_URL

.github/workflows/deploy.yaml

@@ -293,7 +293,7 @@ jobs:
   # must succeed before either the API or worker deploys.
   sync-cw-to-api:
     name: Sync - CW to API
-    needs: [build-api, build-worker]
+    needs: [migrate-api, build-worker]
     runs-on: ubuntu-latest
     steps:
       - name: Set the Kubernetes context

dalpuri/kubernetes/sync-job.yaml

@@ -17,10 +17,12 @@ spec:
       containers:
         - name: sync
           image: ghcr.io/horizonstacksoftware/optima-dalpuri-sync:RELEASE_TAG
-          envFrom:
-            - secretRef:
-                name: api-env-secret
           env:
+            - name: CW_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: api-env-secret
+                  key: CW_DATABASE_URL
             - name: API_DATABASE_URL
               valueFrom:
                 secretKeyRef: