06-Feb-2026 — Migrations, Deploy and 3 more areas: 3 features and 2 fixes #146

build 467 — commit 2f149c0

• Add fly.toml to Dockerfile so it's available in deployed environments
• Simplify fly deployment to read fly.toml directly instead of requiring fallback
• Fix Environment type usage in env-config and env-core
• Add FLICKR_SCRAPE_DUMP_DIR to Environment enum (ref: #146)

secrets: add database-first secrets loading for deployed servers (#146)

Add loadSecretsWithFallback and loadSecretsForEnvironmentFromDatabase to support reading secrets from the database ENVIRONMENTS config when running on deployed servers. Falls back to file-based secrets for local development. Secrets are built from:

• Global aws config and secrets from EnvironmentsConfig
• Per-environment aws, mongo, and secrets from EnvironmentConfig
• MongoDB URI is constructed from mongo config fields

cli: add GitHub secrets sync command for environment management (#146)

Add ngx-cli github command with reconcile, sync, and push subcommands to manage the CONFIGS_JSON GitHub secret from the database source of truth. This enables regular syncing when environments are created or modified.

migrations: harden geocode updates and defaults (#146)

Release notes:

• Migrations: backfill notification config defaults for existing data.
• Migrations: avoid geocode failures when start location is missing.
• Migrations: ensure enquiries system role exists in committee config.
• Setup: extend default committee config and mail model fields.
• Secrets: auto-pull missing secrets from Fly.io machines via flyctl machine exec.
• Secrets: three-tier fallback — database, local file, then live Fly.io instance.
• Secrets: extract shared env parsing to env-parser.ts to avoid circular imports.
• Secrets: cache pulled secrets to local file for subsequent runs.
• Config: distinguish expired tokens from missing tokens on admin-only endpoints.
• Config: return 401 for expired tokens vs 403 for unauthenticated access.

paths: use resolveClientPath for non-vcs file access (#146)

Fix path resolution for secrets and configs.json files when running in production mode where code executes from ts-gen directory.