docs: record first-deployment model and manual schema initialization

.project-docs/40-domain/business-rules.md

@@ -10,13 +10,12 @@
 - All new organization balance entries are organization-owned; generation charge/refund entries keep member attribution for consumption reporting.
 - Logged-in users may change their own password; account management and organization member actions require admin roles.
 - Public `/api/v1` access authenticates with API keys and stays outside browser SSO middleware; API data is partitioned by the API account owner.
-- Database schema changes ship as versioned, checksummed, advisory-locked one-shot migrations; they never run in each Web pod init container.
+- Database schema changes stay versioned and checksummed in `database/migrations/`; the initial production schema is created by manually executing the SQL files plus application-role grants (no migration Job pod), and schema changes must never run inside long-lived pod startup.
 - Generated and uploaded assets remain runtime/object-storage state; PostgreSQL does not make them shared for horizontal scaling.
 
 ## Open Questions
 
-- Whether Go must parse existing `zhinian_session` cookies without logout, or a one-time global re-login is acceptable at cutover.
-- The exact public `/api/v1` compatibility promise to preserve during and after the Go cutover.
+- The exact public `/api/v1` compatibility promise to preserve for external consumers.
 
 ## Last Reviewed