Record deployed Vergabe pilot chart and company sign-in evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

charts/vergabe-teilnahme/Chart.yaml

@@ -4,7 +4,7 @@ description: |
   Vergabe Teilnahme — internal Django tender/bid management web app.
   Single-instance v1 deployment; HA and canary are deferred.
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "0.1.0"
 keywords:
   - django

charts/vergabe-teilnahme/templates/deployment.yaml

@@ -21,7 +21,25 @@ spec:
     metadata:
       labels: {{- include "vergabe.selectorLabels" . | nindent 8 }}
     spec:
+      automountServiceAccountToken: false
       securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- if .Values.migrations.enabled }}
+      initContainers:
+        - name: migrate
+          image: {{ include "vergabe.image" . | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["python", "manage.py", "migrate", "--noinput"]
+          securityContext: {{- toYaml .Values.securityContext | nindent 12 }}
+          envFrom:
+            - secretRef:
+                name: {{ .Values.envSecretName | quote }}
+          env:
+            {{- range $k, $v := .Values.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
+          resources: {{- toYaml .Values.resources | nindent 12 }}
+      {{- end }}
       containers:
         - name: app
           image: {{ include "vergabe.image" . | quote }}

charts/vergabe-teilnahme/values.yaml

@@ -4,6 +4,10 @@ image:
   digest: ""          # preferred; takes precedence over tag
   pullPolicy: IfNotPresent
 
+# Opt in after reviewing migrations; runs before serving traffic, within the same pod request.
+migrations:
+  enabled: false
+
 replicaCount: 1       # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes)
 
 # An invited company pilot requires an immutable image and both data volumes.