Deploy from CI with Infisical and ship Payload changes as migrations

CI reads Infisical staging as the read-only convexmonorepo-ci machine identity, deploys the Convex functions, builds and pushes the image, and asks the VPS to redeploy. Payload schema changes now ship as migrations that production runs on startup; the baseline matches the production schema and is recorded as applied there. The local stack moves to its own ports and syncs the Convex runtime env, and the scripts pick up Infisical account switching, dev-kill and a cache-safe CI install.

docs/payload-cms.md

@@ -6,7 +6,7 @@ the application backend for auth, realtime data, files, and workflows.
 Configuration lives in `apps/next/src/payload.config.ts`. Payload uses
 `PAYLOAD_SECRET`, `PAYLOAD_DB_URL`, and `NEXT_PUBLIC_SITE_URL` from the validated
 environment contract. Local `dev` values come from Infisical and point Payload
-to Postgres at `localhost:5432`, because Next runs on the host.
+to Postgres at `localhost:5436`, because Next runs on the host.
 
 Start the isolated services with `bun db:up`, then run `bun dev:next`. The local
 database persists across `bun db:down`; `bun db:down:wipe` removes it. Local