Upgrade

DB migrations are idempotent and run automatically on API start.

Zero-downtime upgrade

1. Run the new version in parallel (for example via blue/green behind nginx)
2. Health-check: GET /healthz → ok after migrations
3. Switch traffic to the new version
4. The old one stays for a 24-48 hour rollback

Rollback

Migrations are forward-only (we don't write downgrades). A backend rollback is possible only if the new migration didn't break the old code (we avoid drop column / type change in one version). For major versions — back up before the upgrade.