feat: SDLC database separation for CI/testing (#35)

## Summary
- Fix `isProductionDatabase()` to allow CI database (`euchre_camp_ci`)
- Add database schema reset before CI test runs
- Create `global.teardown.ts` for cleanup (CI: full reset, dev/prod: selective cleanup)
- Add `acceptance-tests` job to PR workflow with CI database
- Create `sync-prod-to-dev.js` script for one-way prod→dev sync
- Add `just` recipes: `sync-dev`, `test-prod`, `reset-ci-db`
- Store credentials in `.credentials` (gitignored) with unique CI user

## Testing
Verified against CI database:
- Schema reset works
- Migrations apply correctly
- Test users created successfully
- 219 tests pass (slow but working)

## Next Steps
- Set `CI_DATABASE_URL` as Gitea repository variable

Reviewed-on: #35
Co-authored-by: David Gwilliam <dhgwilliam@gmail.com>
Co-committed-by: David Gwilliam <dhgwilliam@gmail.com>

.gitea/workflows/build-ci-images.yml

@@ -5,14 +5,14 @@ on:
     branches:
       - main
     paths:
-      - 'Dockerfile.ci-base'
-      - 'package.json'
-      - 'bun.lock'
-      - '.gitea/workflows/build-ci-images.yml'
+      - "Dockerfile.ci-base"
+      - "package.json"
+      - "bun.lock"
+      - ".gitea/workflows/build-ci-images.yml"
   schedule:
     # Weekly rebuild to get latest Playwright/Bun versions
-    - cron: '0 2 * * 0'  # Every Sunday at 2 AM
-  workflow_dispatch:  # Manual trigger
+    - cron: "0 2 * * 0" # Every Sunday at 2 AM
+  workflow_dispatch: # Manual trigger
 
 env:
   REGISTRY: docker.notsosm.art
@@ -24,32 +24,32 @@ jobs:
     permissions:
       contents: read
       packages: write
-    
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-      
+
       - name: Login to Registry
         run: |
           echo "${{ secrets.DOCKER_PASSWORD }}" | docker login ${{ env.REGISTRY }} -u ${{ secrets.DOCKER_LOGIN }} --password-stdin
-      
+
       - name: Extract metadata for CI base image
         id: meta
         run: |
           # Get Playwright version from package.json
-          PLAYWRIGHT_VERSION=$(grep -o '"@playwright/test": "[^"]*"' package.json | cut -d'"' -f4)
+          PLAYWRIGHT_VERSION=$(grep -o '"@playwright/test": "[^"]*"' package.json | cut -d'"' -f4 | sed 's/^\^//')
           echo "playwright_version=${PLAYWRIGHT_VERSION}" >> $GITHUB_OUTPUT
-          
+
           # Get Bun version (latest)
           BUN_VERSION=$(bun --version 2>/dev/null || echo "latest")
           echo "bun_version=${BUN_VERSION}" >> $GITHUB_OUTPUT
-          
+
           # Set tags
           echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:latest,${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:playwright-${PLAYWRIGHT_VERSION},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:${{ github.sha }}" >> $GITHUB_OUTPUT
-      
+
       - name: Build and push CI base image
         run: |
           # Build with multiple tags
@@ -58,14 +58,9 @@ jobs:
             --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:latest \
             --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:playwright-${{ steps.meta.outputs.playwright_version }} \
             --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:${{ github.sha }} \
-            .
-          
-          # Push all tags
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:latest
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:playwright-${{ steps.meta.outputs.playwright_version }}
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/ci-base:${{ github.sha }}
-      
+
       - name: Clean up
         if: always()
         run: |
-          docker logout ${{ env.REGISTRY }}
+          docker logout ${{ env.REGISTRY }}
+