Extract API, migrations and portable NAS deployment

infra/synology/create-database.sql.example

@@ -0,0 +1,14 @@
+-- Run as the MariaDB administrator after replacing the password placeholders.
+-- The application account owns only this database and receives no global grants.
+-- 172.29.240.2 is the static container address from both Compose files.
+-- Update this host if you change the bridge subnet. Do not use a wildcard host.
+
+CREATE DATABASE IF NOT EXISTS model_delivery
+  CHARACTER SET utf8mb4
+  COLLATE utf8mb4_unicode_ci;
+
+CREATE USER IF NOT EXISTS 'model_app'@'172.29.240.2'
+  IDENTIFIED BY 'REPLACE_WITH_A_UNIQUE_DATABASE_PASSWORD';
+ALTER USER 'model_app'@'172.29.240.2'
+  IDENTIFIED BY 'REPLACE_WITH_A_UNIQUE_DATABASE_PASSWORD';
+GRANT ALL PRIVILEGES ON model_delivery.* TO 'model_app'@'172.29.240.2';