fix(deploy): login 500s on fresh container

Two bugs kept a fresh docker-compose deploy from ever accepting admin:admin:

1. resolveSqliteUrl in packages/db/src/client.ts stripped leading slashes
   wholesale — so file:/data/vector.db became a relative path and was
   resolved against packages/db/prisma/. Prisma CLI (migrate deploy)
   correctly wrote to /data/vector.db on the mounted volume; the app's
   runtime client connected to an empty file at packages/db/prisma/data/
   vector.db with no tables, so login threw. The helper now passes Unix
   absolute paths through verbatim, still normalizes file:/// triple-
   slash URLs, and only resolves truly relative paths against the schema
   dir.

2. The Dockerfile CMD ran migrations but not a seed, so even when the
   path bug is fixed the User table is empty — admin:admin 401s forever.
   Added packages/db/ensure-admin.mjs (pure JS, no tsx needed) that
   creates the default admin user iff User.count() === 0, and wired it
   into the API CMD between migrate deploy and node. Credentials can be
   overridden with SEED_ADMIN_{USERNAME,PASSWORD,EMAIL}.

apps/api/Dockerfile

@@ -46,5 +46,6 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
   CMD wget -qO- http://localhost:3001/healthz || exit 1
 
 WORKDIR /app/apps/api
-# Apply pending migrations before booting. Prisma reads DATABASE_URL from env.
-CMD ["sh", "-c", "pnpm -C ../../packages/db exec prisma migrate deploy && node dist/index.js"]
+# Apply migrations → seed default admin on empty DB → start API.
+# Override the default admin credentials via SEED_ADMIN_{USERNAME,PASSWORD,EMAIL}.
+CMD ["sh", "-c", "pnpm -C ../../packages/db exec prisma migrate deploy && node ../../packages/db/ensure-admin.mjs && node dist/index.js"]