gate2: prestart.sh sets passwords for all DB roles (crm_api, crm_auth, crm_worker, crm_migration) after migration

Migration 0070 creates roles without passwords. On fresh DB, API cannot authenticate.
prestart.sh now extracts password from MIGRATION_DATABASE_URL and sets it for all roles.

prestart.sh

@@ -27,7 +27,48 @@ echo "[prestart] $(date -u +%Y-%m-%dT%H:%M:%SZ) - Running alembic upgrade head (
 DATABASE_URL="$ALEMBIC_DATABASE_URL" alembic upgrade head
 echo "[prestart] DB migrations completed successfully."
 
-# Set crm_runtime password if RUNTIME_DB_PASSWORD is set
+# Set passwords for all application DB roles (crm_api, crm_auth, crm_worker, crm_migration)
+# Migration 0070 creates these roles without passwords; we set them here so the
+# API/Worker/Auth connections can authenticate.
+echo "[prestart] Setting DB role passwords..."
+python3 -c "
+import asyncio
+import os
+import re
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlalchemy import text
+
+async def set_passwords():
+    db_url = os.environ.get('MIGRATION_DATABASE_URL', os.environ.get('DATABASE_URL', ''))
+    if not db_url:
+        print('[prestart] WARNING: No DB URL for password setup')
+        return
+    # Extract password from the DB URL (postgresql+asyncpg://user:pass@host:port/db)
+    match = re.search(r'://([^:]+):([^@]+)@', db_url)
+    if not match:
+        print('[prestart] WARNING: Could not extract password from DB URL')
+        return
+    pwd = match.group(2)
+    engine = create_async_engine(db_url)
+    roles = ['crm_api', 'crm_auth', 'crm_worker', 'crm_migration']
+    try:
+        async with engine.begin() as conn:
+            for role in roles:
+                try:
+                    await conn.execute(text(f'ALTER ROLE {role} WITH LOGIN PASSWORD :pwd'), {'pwd': pwd})
+                    print(f'[prestart] Password set for {role}')
+                except Exception as e:
+                    print(f'[prestart] WARNING: Could not set password for {role}: {e}')
+        print('[prestart] DB role passwords set.')
+    except Exception as e:
+        print(f'[prestart] WARNING: Could not set DB role passwords: {e}')
+    finally:
+        await engine.dispose()
+
+asyncio.run(set_passwords())
+"
+
+# Set crm_runtime password if RUNTIME_DB_PASSWORD is set (legacy support)
 if [ -n "$RUNTIME_DB_PASSWORD" ]; then
     echo "[prestart] Setting crm_runtime password..."
     python3 -c "