api: fix migration runner, serve uploads correctly, add product photos

Three real bugs found and fixed while wiring up product images end-to-end:

1. src/prisma/migrate.ts only discovered flat prisma/migrations/<name>.sql
   files, never Prisma's own folder-per-migration layout
   (<timestamp>_<name>/migration.sql). Every migration created the normal
   way (via 'prisma migrate dev') was silently skipped; only a hand-added
   flat duplicate (prisma/migrations/0001_init.sql, now removed) ever ran.
   This meant schema.prisma had drifted well ahead of what any real deploy
   database actually had (missing columns on City, Customer, Branch,
   Product, several new tables). Fixed to discover both layouts; the
   drift is closed with a new 20260914165255_sync_schema_drift migration.

2. Neither nginx.conf (production) nor vite.config.ts (dev) proxied
   /uploads/ to the API — only /api/. UploadedFile/ProductImage URLs
   (/uploads/<file>, served by main.ts's useStaticAssets OUTSIDE the /api
   prefix) 404'd through both. Both now proxy /uploads/ the same way /api/
   already was.

3. docker-compose.yml's api service had no volume for storage/uploads, so
   every uploaded file — and by extension every ProductImage row pointing
   at one — was lost on the next container recreate/redeploy. Added a
   named volume.

Also: main.ts's static file serving now sets Content-Type: image/avif
explicitly (serve-static's bundled mime table predates .avif and served it
as application/octet-stream; browsers rendered it anyway by sniffing, but
a stricter client would not have).

Product photos: copied 15 real jewelry photos into the uploads volume,
registered them as UploadedFile rows, and assigned each of the 5 existing
Product rows a randomly picked one (duplicates allowed, per request),
replacing their /img/no-items.png placeholder ProductImage row. Verified
end-to-end in a real browser against the real containerized API+DB: logged
in, opened the admin product list, confirmed all 5 rows render their photo
(naturalWidth/Height populated, network 200s, no console errors).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/main.ts

@@ -2,11 +2,19 @@ import 'reflect-metadata';
 import { NestFactory } from '@nestjs/core';
 import { ValidationPipe } from '@nestjs/common';
 import { NestExpressApplication } from '@nestjs/platform-express';
-import { join } from 'node:path';
+import { extname, join } from 'node:path';
+import type { Response } from 'express';
 import { AppModule } from './app.module';
 import { prepareDatabase } from './prisma/bootstrap';
 import { PrismaExceptionFilter } from './prisma/prisma-exception.filter';
 
+// serve-static's bundled `mime` version predates .avif, so it falls back to
+// application/octet-stream — browsers still render the image (they sniff
+// content), but a strict client or an <img> under some CSPs would not.
+const EXTRA_MIME_TYPES: Record<string, string> = {
+  '.avif': 'image/avif',
+};
+
 async function bootstrap() {
   await prepareDatabase();
 
@@ -21,6 +29,10 @@ async function bootstrap() {
     prefix: '/uploads/',
     index: false,
     dotfiles: 'deny',
+    setHeaders: (res: Response, path: string) => {
+      const mime = EXTRA_MIME_TYPES[extname(path).toLowerCase()];
+      if (mime) res.setHeader('Content-Type', mime);
+    },
   });
   // Bind all interfaces explicitly so the container is reachable from nginx.
   await app.listen(process.env.PORT ?? 3000, '0.0.0.0');