feat(deploy): sync schema to replication subscribers before migrating

Logical replication carries rows but not DDL, so a migration that adds a
column stalls every subscriber with "missing replicated columns" until the
column exists there too. _prisma_migrations is replicated, so migrate deploy
on a subscriber reports nothing pending while its tables lag behind.

sync-replica-schema.sh applies pending migrations to each subscriber first,
tracking them locally in _replica_ddl_applied, then migrates the publisher.
--check reports subscription state and columns missing on any replica.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitignore

@@ -10,6 +10,9 @@ coverage
 .env.local
 .env.*.local
 
+# replica DSNs contain live DB passwords
+deploy/replicas.env
+
 # SMS import target files may contain live DB passwords
 prisma/khanegi-sms-targets.json
 prisma/*-sms-targets.json