Read CI env from Infisical and give the local stack its own ports

CI reads Infisical staging as the read-only convexmonorepo-base-ci machine identity, runs the quality gate, and builds and pushes the image. The template is not deployed, so there is no Convex or VPS deploy step. The local stack moves to its own Compose name and ports so it runs beside the Payload template's, and it syncs the Convex runtime env. The scripts pick up Infisical account switching, dev-kill and a cache-safe CI install.

scripts/db/up

@@ -44,9 +44,9 @@ refresh_env
 info "Starting local Convex and dashboard"
 dc up -d
 
-info "Waiting for Convex at http://localhost:${BACKEND_PORT:-3210}"
+info "Waiting for Convex at http://localhost:${BACKEND_PORT:-3250}"
 for i in $(seq 1 60); do
-  curl -fs "http://localhost:${BACKEND_PORT:-3210}/version" >/dev/null 2>&1 && break
+  curl -fs "http://localhost:${BACKEND_PORT:-3250}/version" >/dev/null 2>&1 && break
   [ "$i" -lt 60 ] || die "Convex did not become ready."
   sleep 2
 done
@@ -62,6 +62,11 @@ fi
 info "Deploying Convex schema and functions"
 (cd "$ROOT_DIR/packages/backend" && bun run setup)
 
+# Env sync runs after the deploy: changing deployment env re-analyzes the
+# deployed modules, which fails on a fresh volume before the first deploy.
+info "Synchronizing the Convex function runtime environment"
+sh "$ROOT_DIR/scripts/with-env" dev -- bash "$ROOT_DIR/scripts/sync-local-convex-env"
+
 convex_env_names="$(
   sh "$ROOT_DIR/scripts/with-env" dev -- bash -c \
     'cd packages/backend && bunx convex env list' 2>/dev/null \
@@ -82,4 +87,4 @@ if ! printf '%s\n' "$convex_env_names" | grep -qx 'JWT_PRIVATE_KEY' \
   '
 fi
 
-printf '\nLocal stack ready:\n  App: http://localhost:3000\n  Convex: http://localhost:%s\n  Dashboard: http://localhost:%s\n' "${BACKEND_PORT:-3210}" "${DASHBOARD_PORT:-6791}"
+printf '\nLocal stack ready:\n  App: http://localhost:3000\n  Convex: http://localhost:%s\n  Dashboard: http://localhost:%s\n' "${BACKEND_PORT:-3250}" "${DASHBOARD_PORT:-6795}"