feat: add RUN_SEED support and nullable tenantId migration

- New migration: make users.tenantId nullable for super_admin
- Dockerfile: RUN_SEED=true env var triggers seed after migrations
- Seed uses npx tsx (available in node_modules)

packages/db/prisma/migrations/20260415000000_make_user_tenantid_nullable/migration.sql

@@ -0,0 +1,12 @@
+-- AlterTable: make tenantId nullable for super_admin users
+ALTER TABLE "users" ALTER COLUMN "tenantId" DROP NOT NULL;
+
+-- Fix FK to allow NULL (super_admin has no tenant)
+ALTER TABLE "users" DROP CONSTRAINT "users_tenantId_fkey";
+ALTER TABLE "users" ADD CONSTRAINT "users_tenantId_fkey"
+  FOREIGN KEY ("tenantId") REFERENCES "tenants"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- Drop unique index that requires tenantId (email must be unique globally for super_admin)
+DROP INDEX IF EXISTS "users_tenantId_email_key";
+CREATE UNIQUE INDEX "users_tenantId_email_key" ON "users"("tenantId", "email") WHERE "tenantId" IS NOT NULL;
+CREATE UNIQUE INDEX "users_email_key" ON "users"("email") WHERE "tenantId" IS NULL;