fix: disable TypeORM synchronize in production and staging

[AzahasTech]

Overview

This PR hardens database startup behavior by ensuring TypeORM synchronize is never enabled in production-like environments. Schema synchronization can mutate production data unexpectedly, so production and staging now force synchronize: false, making migrations the only supported schema-change path. An automated configuration test prevents regressions and documents the expected behavior for future changes.

Related Issue

Closes #BA-025

Changes

🔒 TypeORM Synchronization Hardening

• [MODIFY] src/config/env.schema.ts

  • Adds environment-aware database validation.
  • Rejects DB_SYNCHRONIZE=true when NODE_ENV is production or staging.

• [MODIFY] src/database/database.module.ts

  • Forces synchronize: false for production and staging.
  • Uses validated configuration instead of raw environment variables.
  • Keeps synchronize opt-in only for local development and test environments.

• [ADD] src/database/database.module.spec.ts

  • Verifies synchronize is false for both production and staging.
  • Asserts migrations remain the only schema-change path.
  • Prevents future regressions that could reintroduce dangerous schema sync.

• [MODIFY] src/config/config.module.ts

  • Ensures the environment schema is validated before database configuration is resolved.

• [MODIFY] .env.example

  • Documents DB_SYNCHRONIZE=false as the safe default.
  • Adds comments explaining that migrations are required in production and staging.

Verification Results

npm test -- src/database/database.module.spec.ts
✅ 12/12 passed

Live acceptance check:
✅ synchronize=false for production
✅ synchronize=false for staging
✅ Migration-only schema-change path enforced
✅ Regression test fails if synchronize is enabled in production/staging

Acceptance Criteria	Status
Synchronize is false for production and staging	✅ Verified in database module and env schema tests
Migrations are the only schema-change path	✅ Production/staging cannot enable synchronize; migration workflow documented
A configuration test prevents regressions	✅ Automated spec rejects synchronize in production-like environments

Closes #593

[drips-wave]

@AzahasTech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[MaryammAli]

LGTM