fix: hold the Postgres bootstrap lock across schema creation and seeding

Booting several replicas against one fresh Postgres database left all but
one dead on startup: the advisory lock only covered EnsureCreated, so the
seeders (system account, rooms, playlists, store, ...) raced and hit
duplicate keys. Take a session-level advisory lock for the whole bootstrap
and release it explicitly (pooled connections would otherwise keep it).
The upgrades and seeds both providers run move into
RunUpgradesAndSeedsAsync.

DorkNet.Server/Startup/DatabaseBootstrap.cs

@@ -15,9 +15,9 @@ namespace DorkNet.Server.Startup;
 ///   <item>SQLite — <c>Database.Migrate()</c> after
 ///   <see cref="BaselineExistingSchemaIfNeeded"/> reconciles any legacy
 ///   migration-history state.</item>
-///   <item>Postgres — <c>EnsureCreated</c> behind a transaction-scoped
+///   <item>Postgres — <c>EnsureCreated</c>, with the whole bootstrap
-///   advisory lock so concurrent replica boots don't race on
+///   (schema and seeds) behind a session advisory lock so concurrent
-///   <c>CREATE TABLE</c>. Connect retries cover the
+///   replica boots take turns instead of racing. Connect retries cover the
 ///   container-orchestrated boot window where Postgres DNS isn't
 ///   resolvable yet.</item>
 /// </list>
@@ -40,21 +40,23 @@ public static class DatabaseBootstrap
             await ConfigureSqliteForLocalConcurrencyAsync(db);
             BaselineExistingSchemaIfNeeded(db);
             db.Database.Migrate();
+            await RunUpgradesAndSeedsAsync(app, scope, db);
+            return;
         }
-        else
+
-        {
         // Postgres path: schema generated from the EF Core model via
-            // EnsureCreated. Wrapped in a transaction-scoped advisory lock
+        // EnsureCreated, then the same upgrades and seeds as SQLite. The
-            // so concurrent replicas booting against the same database
+        // whole bootstrap holds a session-level advisory lock, so replicas
-            // don't race on CREATE TABLE — only the first replica to take
+        // booting against one database take turns: the first creates the
-            // the lock runs EnsureCreated, the rest see "schema already
+        // schema and seeds, the rest find everything in place. Holding it
-            // exists" and proceed.
+        // only around EnsureCreated left the seeders racing (duplicate keys
+        // on a fresh database).
         //
-            // Lock key 0x444F524B (ascii "DORK") is hard-coded; it just
+        // Lock key 0x444F524B (ascii "DORK") is hard-coded; it just needs
-            // needs to be the same int64 across replicas and not collide
+        // to be the same int64 across replicas and not collide with
-            // with anything else in the database. pg_advisory_xact_lock
+        // anything else in the database. It is released in the finally
-            // releases automatically on COMMIT, so a crashed replica can't
+        // below, and Postgres drops it if the replica's connection dies, so
-            // wedge the next boot.
+        // a crashed replica can't wedge the next boot.
         var conn = db.Database.GetDbConnection();
 
         // Retry initial Postgres connect — on container-orchestrated boots
@@ -82,20 +84,40 @@ public static class DatabaseBootstrap
                 await Task.Delay(delay);
             }
         }
+
+        // The connection stays open until the finally, so every step below
+        // (they all share this scope's DbContext) runs on the session that
+        // holds the lock.
+        await db.Database.ExecuteSqlRawAsync("SELECT pg_advisory_lock(1146246987);");
+        try
+        {
             // Begin the transaction through EF, not on the raw connection:
-            // since EF Core 10, EnsureCreated runs its commands through the
+            // EnsureCreated runs its commands through the migration executor,
-            // migration executor, which starts its own transaction unless EF
+            // which starts its own transaction unless EF already has one, and
-            // already has one, and fails on a fresh database with "A
+            // fails on a fresh database with "A transaction is already in
-            // transaction is already in progress" when the open one is
+            // progress" when the open one is invisible to it.
-            // invisible to it.
+            await using (var tx = await db.Database.BeginTransactionAsync())
-            await using var tx = await db.Database.BeginTransactionAsync();
+            {
-            await db.Database.ExecuteSqlRawAsync("SELECT pg_advisory_xact_lock(1146246987);");
                 db.Database.EnsureCreated();
                 await tx.CommitAsync();
-
+            }
+            await RunUpgradesAndSeedsAsync(app, scope, db);
+        }
+        finally
+        {
+            // Explicit: Npgsql pools connections, so closing alone would not
+            // end the session that holds the lock.
+            await db.Database.ExecuteSqlRawAsync("SELECT pg_advisory_unlock(1146246987);");
             await conn.CloseAsync();
         }
+    }
 
+    /// <summary>The idempotent post-schema sequence both providers run:
+    /// column/table upgrades, system account and backfills, legacy data
+    /// transforms, canonical rooms and the per-feature seeders. Flips the
+    /// <c>/healthz</c> readiness flag at the end.</summary>
+    private static async Task RunUpgradesAndSeedsAsync(WebApplication app, IServiceScope scope, DorkNetDbContext db)
+    {
         // Signup-code + pending-device tables. These post-date the
         // consolidated Initial migration, and the Postgres path is
         // EnsureCreated-only (no migration replay), so neither provider