fix(deploy): three real bugs caught running the full docker stack e2e

[acedatacloud-dev]

Why

PR #11 shipped the Docker + K8s deploy scaffold but I only verified docker compose build succeeded. Running docker compose up -d and walking the full Phantom-auth → create-vault → MCP-session flow against the live stack surfaced three real bugs. This PR fixes all three; the same flow now succeeds end-to-end.

Bugs and fixes

1. uvicorn binary not on $PATH

pip install --target=/install in the API Dockerfile's builder stage skips bin/ scripts. The runtime image then crashed with:

exec: "uvicorn": executable file not found in $PATH: unknown

Fix: invoke via python -m uvicorn so we don't depend on bin shims surviving the --target install.

2. Postgres tables never created on first boot

The lifespan hook only ran init_models() for SQLite URLs. Production runs Alembic so that gate was right for prod, but wrong for docker compose up which uses the same Postgres engine prod uses.

UndefinedTableError: relation "mcp_sessions" does not exist

Fix: also run init_models() when APP_ENV != "production". SQLite path unchanged. Production still bypasses (Alembic owns schema there).

3. CONNECTION_VAULT_KEY YAML-parsed as integer 0

CONNECTION_VAULT_KEY: 0000000000000000000000000000000000000000000000000000000000000000

YAML treats long all-zero numerics as int. The container saw CONNECTION_VAULT_KEY=0 and crashed:

RuntimeError: CONNECTION_VAULT_KEY must be hex

Fix: quote the value as a string. .env.example was already right because dotenv files are pure text.

Verification — full stack walked end-to-end

$ docker compose up -d --build
$ python e2e_smoke.py
  AUTH_OK              challenge → Ed25519 sign → session token
  CREATE_OK            vault_pda=6kPj8M1d... tx_b64_len=756
  LIST_OK              count=1
  MCP_SESSION_OK       /mcp/EOtTcPBh... bound to vault
  MCP_TOOLS_LIST_OK    4 tools: aceguard_balance, aceguard_history,
                       aceguard_spend, aceguard_pay_for_api

$ cd api && PYTHONPATH=.. pytest tests/
  35 passed in 0.53s

Backend test suite unchanged because the lifespan-hook change is a pure relaxation (broader cases run init_models, narrower cases unchanged), and tests use SQLite which already took the SQLite branch.