feat(deploy): switch to Oracle MySQL, separate CI runner, docker-compose deploy

- Prisma schema: sqlite → mysql provider
- Migration SQL rewritten as MySQL DDL (utf8mb4, DATETIME(3), AUTO_INCREMENT)
- Add migration_lock.toml for mysql provider
- Dockerfile.backend: drop node:22/sqlite deps, use node:20-slim
- entrypoint.sh: replace SQLite first-run logic with prisma migrate deploy + db seed
- docker-compose.prod.yml: production compose for /opt/webapps/okr on web VPS
  - reads DB creds from /opt/webapps/webapp-mysql.env
  - reads app secrets from /opt/webapps/okr/.env.app (written by CI)
  - port 80 (frontend), no conflict with Gitea 3000/Vault 8200
- ci.yml deploy-okr: moves from ubuntu-latest (web VPS) to ci-runner (161.33.149.243)
  - builds images on CI runner VPS (no heavy build on web/Gitea VPS)
  - transfers images via docker save | gzip | ssh | docker load
  - deploys via SSH + docker compose up on web VPS
- scripts/setup-ci-runner.sh: one-time setup script for CI runner VPS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AINative_OKR_CASAN5/docker-compose.prod.yml

@@ -0,0 +1,42 @@
+version: '3.8'
+
+# Production deployment for VPS: /opt/webapps/okr/
+# DB credentials come from /opt/webapps/webapp-mysql.env (managed on VPS, not in repo).
+# App secrets (JWT_SECRET) come from /opt/webapps/okr/.env.app (written by CI deploy step).
+# Ports in use on this VPS — DO NOT conflict:
+#   3000 = Gitea HTTP, 2222 = Gitea SSH, 8200 = Vault
+
+services:
+  okr-backend:
+    image: okr-backend:latest
+    container_name: okr-backend
+    restart: unless-stopped
+    env_file:
+      - /opt/webapps/webapp-mysql.env   # DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD, DATABASE_URL
+      - /opt/webapps/okr/.env.app        # JWT_SECRET, FRONTEND_ORIGIN
+    environment:
+      PORT: "3001"
+      NODE_ENV: production
+    mem_limit: 256m
+    cpus: "0.5"
+    networks:
+      - okr-net
+    expose:
+      - "3001"
+
+  okr-frontend:
+    image: okr-frontend:latest
+    container_name: okr-frontend
+    restart: unless-stopped
+    ports:
+      - "80:80"
+    mem_limit: 64m
+    cpus: "0.25"
+    networks:
+      - okr-net
+    depends_on:
+      - okr-backend
+
+networks:
+  okr-net:
+    driver: bridge