REFACTORED - migrate the data layer from Prisma to Drizzle (unify the stack)

- Add lib/db (Drizzle schema: 7 tables + 6 enums + relations, postgres.js client),
  drizzle.config.ts, lib/db/enums.ts (Prisma-compatible enum objects)
- Rewrite all 14 app consumers + 4 admin components to Drizzle
- Move the test DB layer to Drizzle + in-process PGlite; convert all 8 integration
  test files + factories (371 tests green)
- Remove Prisma: deps, prisma/ schema+migrations, lib/prisma.ts, Dockerfile prisma
  generate; wire db:generate/migrate/push/studio to drizzle-kit; update Makefile
- Preserve the old seed as scripts/legacy-prisma-seed.cjs (needs a Drizzle rewrite)

tests/integration/actions-media.test.ts

@@ -10,8 +10,11 @@ vi.mock("@/lib/admin-auth", async () => {
   return { isAdminAuthenticated: m.isAdminAuthenticated, clearAdminSessionCookie: m.clearAdminSessionCookie };
 });
 
+import { eq } from "drizzle-orm";
+
 import { createMediaAssetAction, deleteMediaAssetAction } from "@/app/_admin/media/actions";
-import { prisma } from "@/lib/prisma";
+import { db } from "@/lib/db";
+import { mediaAsset } from "@/lib/db/schema";
 import { removeManagedMediaFile } from "@/lib/media-storage";
 import { createMediaAsset, createMediaUsage } from "@/tests/helpers/factories";
 import { canManageUploads } from "@/tests/helpers/fs-capability";
@@ -25,7 +28,7 @@ describe("createMediaAssetAction", () => {
   it("errors when no file is provided", async () => {
     const url = await captureRedirect(() => createMediaAssetAction(formDataFrom({ kind: "IMAGE", label: "L" })));
     expect(url).toContain("error=");
-    expect(await prisma.mediaAsset.count()).toBe(0);
+    expect(await db.$count(mediaAsset)).toBe(0);
   });
 
   it.skipIf(!canManageUploads)("creates an asset from an uploaded file", async () => {
@@ -34,7 +37,7 @@ describe("createMediaAssetAction", () => {
       createMediaAssetAction(formDataFrom({ kind: "IMAGE", label: "Pic", file })),
     );
     expect(url).toContain("success=");
-    const assets = await prisma.mediaAsset.findMany();
+    const assets = await db.select().from(mediaAsset);
     expect(assets.length).toBe(1);
     expect(assets[0].source).toBe("UPLOAD");
     await removeManagedMediaFile(assets[0].url);
@@ -58,14 +61,14 @@ describe("deleteMediaAssetAction", () => {
     await createMediaUsage(asset.id);
     const url = await captureRedirect(() => deleteMediaAssetAction(formDataFrom({ assetId: asset.id })));
     expect(url).toContain("error=");
-    expect(await prisma.mediaAsset.findUnique({ where: { id: asset.id } })).not.toBeNull();
+    expect((await db.query.mediaAsset.findFirst({ where: eq(mediaAsset.id, asset.id) })) ?? null).not.toBeNull();
   });
 
   it("deletes an unused external asset", async () => {
     const asset = await createMediaAsset({ url: "https://cdn/external.png" });
     const url = await captureRedirect(() => deleteMediaAssetAction(formDataFrom({ assetId: asset.id })));
     expect(url).toContain("success=");
-    expect(await prisma.mediaAsset.findUnique({ where: { id: asset.id } })).toBeNull();
+    expect((await db.query.mediaAsset.findFirst({ where: eq(mediaAsset.id, asset.id) })) ?? null).toBeNull();
   });
 
   it("redirects unauthenticated callers to the admin root", async () => {