Merge current features with security hardening and automatic safe initialization

scripts/start-production.sh

@@ -1,4 +1,12 @@
 #!/bin/sh
 set -eu
-# Apply reviewed migrations separately before starting the runtime.
+cd "$(dirname "$0")/.."
+if [ -n "${APP_DATABASE_PASSWORD_FILE:-}" ]; then
+  DATABASE_URL="$(node scripts/runtime-database-url.mjs)"
+  export DATABASE_URL
+fi
+# Schema changes are applied by the maintenance image before runtime startup.
+if [ -n "${NOTDIENST_JOB_SECRET:-}" ]; then
+  node scripts/notdienst-alarm-worker.mjs &
+fi
 exec node server.js