refinement phase 7

server/src/API/Baya.Web.Api/Controllers/V1/AdminPayoutsController.cs

@@ -42,7 +42,9 @@ public sealed class AdminPayoutsController(ISender sender) : BaseController
     [HttpPost("batches")]
     [ProducesOkApiResponseType<GeneratePayoutBatchResult>]
     public async Task<IActionResult> Generate(GeneratePayoutBatchCommand command, CancellationToken cancellationToken)
-        => OperationResult(await sender.Send(command, cancellationToken));
+        // SystemInitiated is scheduler-only — neutralize any request-supplied value so an API caller can never
+        // record a batch without an authenticated admin initiator (refinement-phase-7).
+        => OperationResult(await sender.Send(command with { SystemInitiated = false }, cancellationToken));
 
     [HttpPost("batches/{id}/process")]
     [ProducesOkApiResponseType<ExecutePayoutBatchResult>]

server/src/API/Baya.Web.Api/Program.cs

@@ -110,22 +110,43 @@ builder.Services.ConfigureGrpcPluginServices();
 var app = builder.Build();
 
 
-// Integration tests (WebApplicationFactory, env "Testing") run on in-memory SQLite — the SQL Server
-// migrations can't apply there; the test factory does EnsureCreated + seeding itself.
-if (!app.Environment.IsEnvironment("Testing"))
+// Deploy-time migration one-shot (refinement-phase-7): `dotnet run -- migrate` (or `<binary> migrate`) applies
+// EF migrations + the idempotent seeders, then exits. Running DDL as a separate deploy step means normal boots —
+// especially concurrent multi-instance start-ups — never race on schema, and the runtime login needs no
+// permanent DDL rights.
+if (args.Any(a => string.Equals(a, "migrate", StringComparison.OrdinalIgnoreCase)))
 {
     await app.ApplyMigrationsAsync();
     await app.SeedDefaultUsersAsync();
-
-    // Development-only: a sandbox payment gateway (all-zeros merchant id) and a demo marketplace
-    // (nurses/variants/search rows, customers/patients) so the real-path screens aren't empty. Neither
-    // belongs in a deployed DB — a production gateway is an admin action, so this never runs in
-    // Production/Staging. Both are idempotent.
     if (app.Environment.IsDevelopment())
     {
         await app.SeedPaymentGatewaysAsync();
         await app.SeedDemoWorldAsync();
     }
+    return;
+}
+
+// Integration tests (WebApplicationFactory, env "Testing") run on in-memory SQLite — the SQL Server
+// migrations can't apply there; the test factory does EnsureCreated + seeding itself.
+if (!app.Environment.IsEnvironment("Testing"))
+{
+    if (app.Environment.IsDevelopment())
+    {
+        // Local convenience: apply migrations + seed on boot. Development-only: a sandbox payment gateway
+        // (all-zeros merchant id) and a demo marketplace (nurses/variants/search rows, customers/patients) so the
+        // real-path screens aren't empty. Neither belongs in a deployed DB — both are idempotent.
+        await app.ApplyMigrationsAsync();
+        await app.SeedDefaultUsersAsync();
+        await app.SeedPaymentGatewaysAsync();
+        await app.SeedDemoWorldAsync();
+    }
+    else
+    {
+        // Deployed: DDL is the separate `migrate` step above. Boot only *checks* the schema is current (fail fast
+        // on a pending migration) and seeds idempotent runtime data (roles + any configured break-glass admin).
+        await app.EnsureSchemaUpToDateAsync();
+        await app.SeedDefaultUsersAsync();
+    }
 }
 
 if (app.Environment.IsDevelopment())