CI: deploy ssh.dodotech.cloud after the image is pushed, and fail unless it comes back ready

The image job pushed :main and stopped there, so nothing told the Spelunk
stack a new image existed and a commit carrying a migration never reached
the server's schema.

A deploy job now calls the stack's deploy hook with SPELUNK_DEPLOY_TOKEN and
then waits up to ten minutes for /healthz/ready. The new container applies
pending migrations as it starts, and readiness stays unhealthy while any is
pending, so a migration that did not apply fails the run instead of passing
quietly.

The Dockerfile no longer says nothing migrates from inside the container,
which had stopped being true and pointed at the setting that causes this.

src/DodoSSH.Api/Dockerfile

@@ -139,7 +139,8 @@ EXPOSE 8080
 # without are DODOSSH_ConnectionStrings__Postgres, DODOSSH_Oidc__Authority and — on more
 # than one node — DODOSSH_Sync__CursorSigningKey.
 #
-# Nothing migrates the database from in here. That is the API's own design: it fails
-# /healthz/ready while a migration is pending and names it, so the schema is applied by
-# `dotnet ef database update` alongside the deployment rather than by a racing container.
+# The process migrates the database itself as it starts, before its port opens and under an
+# advisory lock so two replicas cannot race (Database:AutoMigrate, on by default). Leave it on
+# for ssh.dodotech.cloud: the CI deploy job relies on it. Turned off, /healthz/ready fails
+# while a migration is pending and names it, and something else has to apply the schema.
 ENTRYPOINT ["dotnet", "DodoSSH.Api.dll"]