added migration

docs/image-build.md

@@ -8,8 +8,8 @@ architecture** (typically `linux/amd64`) and publishes `:latest` to:
 gitea.cptckp.com/nurinda/recruitment-hc
 ```
 
-Only the PHP/Apache app is built; MySQL and phpMyAdmin retain their official
-images. Database exports and host credentials are excluded by `.dockerignore`.
+Only the PHP/Apache image is built (used by both `app` and `migrate`); MySQL,
+`db-init`, and phpMyAdmin retain their official images. Database exports and host credentials are excluded by `.dockerignore`.
 
 ## Setup
 
@@ -69,6 +69,8 @@ Stack run directory, for example `compose.image.yaml`:
 services:
   app:
     image: gitea.cptckp.com/nurinda/recruitment-hc:latest
+  migrate:
+    image: gitea.cptckp.com/nurinda/recruitment-hc:latest
 ```
 
 Prefer replacing `:latest` with the tested image digest (`@sha256:...` instead
@@ -81,10 +83,12 @@ file paths, in that order. Then:
 - Configure Komodo's Registry provider/account for `gitea.cptckp.com`; for private
   packages, use a token with **Packages: Read** on an account allowed to pull them.
   Keep this separate from the CI write token.
-- Keep the Compose project name and volumes unchanged. Imports/migrations remain
-  explicit; follow [the deployment guide](deployment.md).
+- Use the same tested image/digest for `app` and `migrate`.
+- Keep the Compose project name and volumes unchanged. Set `DB_INIT_SQL_PATH` to
+  a trusted dump on the Docker host. Initialization/migrations run automatically;
+  follow [the deployment guide](deployment.md).
 
-Compose retains the base file's `build` declaration in this simple override. Use
+Compose retains both services' base `build` declarations in this simple override. Use
 `docker compose ... up -d --no-build` for manual deployments of the CI image
 (after registry login and `docker compose ... pull`); do **not** use `--build`.
 Komodo's Auto pull supplies the image before `up`, with Run build disabled.