Add a lightweight schema migration runner, fix missing PHPMailer in prod image

docker-entrypoint-initdb.d only applies db/init.sql, and only on a brand new
volume - existing installs never got db/migrations/*.sql applied unless
someone ran them by hand. This bit twice this session (qr-oss's own init.sql
was missing a migration, and qr-vip's live DB was two migrations behind after
a code deploy). scripts/migrate.php now runs automatically on every container
start via a new entrypoint wrapper, applying any not-yet-recorded migration -
safe to run repeatedly since every migration file already checks
information_schema before altering.

Also caught in the process: Dockerfile.fpm (the production image) never
installed phpmailer/phpmailer, unlike the dev Dockerfile - meaning
self-registration's password email has been silently fatal-erroring in
production since the nginx+php-fpm switch.

docker-compose.yml

@@ -16,11 +16,9 @@ services:
       DATABASE_PREFIX: "${DATABASE_PREFIX:-}"
       DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}"
       ALLOW_SELF_REGISTRATION: "${ALLOW_SELF_REGISTRATION:-false}"
-      # This file is also what vm420 runs in production (not docker-compose.prod.yml -
-      # see the "prod" naming is misleading, this is the actually-deployed one). Defaults
-      # here are dev-convenience only (mailhog, no auth) - a real deployment's .env must
-      # override MAIL_HOST/MAIL_SMTP_AUTH/MAIL_USERNAME/MAIL_PASSWORD explicitly, same as
-      # DATABASE_PASSWORD above already requires.
+      # Defaults here are dev-convenience only (mailhog, no auth) - a real deployment's
+      # .env must override MAIL_HOST/MAIL_SMTP_AUTH/MAIL_USERNAME/MAIL_PASSWORD
+      # explicitly, same as DATABASE_PASSWORD above already requires.
       MAIL_HOST: "${MAIL_HOST:-mailhog}"
       MAIL_PORT: "${MAIL_PORT:-1025}"
       MAIL_ENCRYPTION: "${MAIL_ENCRYPTION:-}"