Add code to create minio bucket

docs/25-gitea-cicd-docker-deploy.md

@@ -147,7 +147,7 @@ FROM src AS migrate
 RUN dotnet ef migrations bundle ... --output /out/migrate-api
 ```
 
-CD builds `--target migrate`, copies the binary out, and runs it with a **DDL** connection string that never enters the API container. Prefer `docker build` + `docker cp` over `docker run -v` on act_runner — bind mounts resolve on the Docker host, not the job workspace.
+CD builds `--target migrate`, copies the binary out, SCPs it to the deploy host, and runs it on the `shared-services` Docker network with a **DDL** connection string that never enters the API container. Prefer `docker build` + `docker cp` over `docker run -v` on act_runner — bind mounts resolve on the Docker host, not the job workspace.
 
 ### `.dockerignore`
 
@@ -272,7 +272,7 @@ build-and-push ──► migrate ──► deploy (smoke + rollback on failure)
 
 1. Build `--target migrate`
 2. Extract `migrate-api`
-3. `./migrate-api --connection "${{ secrets.PG_CONNECTION_DDL }}"`
+3. `scp` the binary to the deploy host and `docker run --network shared-services` it with `--connection "${{ secrets.PG_CONNECTION_DDL }}"` (Postgres is on that network — not reachable from `act_runner`)
 
 Migrations must be **backwards-compatible** with the still-running previous image (expand-then-contract). Rollback restores the old image tag only — it does not reverse schema.