rebuild(deploy): add Portainer preflight stack

next/tests/test_deployment_assets.py

@@ -0,0 +1,28 @@
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_formal_compose_accepts_portainer_environment_without_env_file() -> None:
+    compose = ROOT.joinpath("compose.yaml").read_text(encoding="utf-8")
+
+    assert "env_file:" not in compose
+    assert "APP_ENCRYPTION_KEY: ${APP_ENCRYPTION_KEY:?" in compose
+    assert "${APP_STORAGE_PATH:-./data}:/app/data" in compose
+    assert '"${APP_PUBLISH_PORT:-8876}:8765"' in compose
+    assert "read_only: true" in compose
+    assert "no-new-privileges:true" in compose
+    assert "cap_drop:\n      - ALL" in compose
+
+
+def test_preflight_migrates_before_web_and_cannot_default_to_formal_storage() -> None:
+    compose = ROOT.joinpath("compose.preflight.yaml").read_text(encoding="utf-8")
+
+    storage_guard = "${APP_STORAGE_PATH:?APP_STORAGE_PATH must be a dedicated preflight directory}"
+    assert storage_guard in compose
+    assert "/app/data/legacy-review.db" in compose
+    assert "/app/data/xiaobai.db" in compose
+    assert "/app/data/migration-report.json" in compose
+    assert "condition: service_completed_successfully" in compose
+    assert '"${APP_PUBLISH_PORT:-8876}:8765"' in compose
+    assert "8765:8765" not in compose