feat: add signed PostgreSQL release updates

oa-backend/src/main/resources/application-postgres.yml

@@ -1,22 +1,29 @@
-# PostgreSQL profile stub. Activate with: --spring.profiles.active=postgres
-# Add the Postgres driver to build.gradle before using:
-#   runtimeOnly 'org.postgresql:postgresql'
-#
-# Switching from SQLite to PostgreSQL is config-only: the JPA entities and the
-# ddl-auto strategy below recreate/update the schema on the Postgres server.
+# Production PostgreSQL profile. Activate with SPRING_PROFILES_ACTIVE=postgres.
+# Credentials are intentionally supplied by the installer/runtime environment.
 
 spring:
   datasource:
-    url: jdbc:postgresql://localhost:5432/oa
+    url: ${OA_DB_URL}
     driver-class-name: org.postgresql.Driver
-    username: oa
-    password: oa
+    username: ${OA_DB_USERNAME}
+    password: ${OA_DB_PASSWORD}
+    hikari:
+      maximum-pool-size: ${OA_DB_POOL_MAX:20}
+      minimum-idle: ${OA_DB_POOL_MIN:2}
+      connection-timeout: 10000
+      validation-timeout: 5000
   jpa:
     hibernate:
-      ddl-auto: update
+      ddl-auto: validate
     database-platform: org.hibernate.dialect.PostgreSQLDialect
     open-in-view: false
     show-sql: false
     properties:
       hibernate:
         dialect: org.hibernate.dialect.PostgreSQLDialect
+  flyway:
+    enabled: true
+    locations: classpath:db/migration/postgresql
+    clean-disabled: true
+    validate-on-migrate: true
+    baseline-on-migrate: false