Prod hardening and K8s drafts: auth fail-close, DB pool, init/schema split, prod init guard

src/app/api/db/init/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from 'next/server';
-import { initSchema, seed, resetDatabase } from '@/lib/schema';
+import { initSchema, seed, resetDatabase, migrateFromLegacyPlaces } from '@/lib/schema';
 
 export async function POST(request: Request) {
+  if (process.env.NODE_ENV === 'production') {
+    return NextResponse.json({ error: 'Database initialization is disabled in production' }, { status: 403 });
+  }
+
   try {
     const { searchParams } = new URL(request.url);
     const reset = searchParams.get('reset') === 'true';
@@ -12,6 +16,7 @@ export async function POST(request: Request) {
     }
 
     await initSchema();
+    await migrateFromLegacyPlaces();
     await seed();
     return NextResponse.json({ ok: true });
   } catch (error) {