ci: check the generated code; deploy: migrate before the switch

Two of Serverpod's own conventions, as its v4 project template and roles have them.

CI now runs `serverpod generate` (CLI pinned to the server's Serverpod version, like
the template's workflow) and fails if the committed generated code differs from its
output, so a model or endpoint changed without regenerating can't reach main. Checked in
a clean clone: today's code passes, a committed stale generated file fails.

redeploy.sh now applies the migrations in a run of their own, with Serverpod's
maintenance role (--role=maintenance --apply-migrations), after the dump and before
switching to the new server. That run exits with 0 only if the migrations worked, and
each migration is one transaction, so a failing one stops the deploy while the old
server keeps serving; before, the new server applied them at start and would have
crash-looped. Tested on the local stack: a deploy through the new step, and a failing
run (wrong database password) that exits with 1 after six attempts. AGENTS.md says
migrations must keep the old server working until the switch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

.forgejo/workflows/ci.yaml

@@ -18,6 +18,9 @@ jobs:
     env:
       # The Flutter the app is developed with; move it together with the local one.
       FLUTTER_VERSION: 3.47.5
+      # The Serverpod CLI, for the generated-code check: the server's Serverpod version
+      # (the root pubspec's overrides); move it together with them.
+      SERVERPOD_VERSION: 4.0.3
     steps:
       # Before anything else runs, the job proves it can neither see nor reach production
       # (the runner's sandbox, deploy/runner/). If it can, nothing else should run.
@@ -71,6 +74,22 @@ jobs:
       - name: Dependencies
         run: flutter pub get
 
+      # The generated code (the server's lib/src/generated, the client package) is
+      # committed, so it has to be exactly what the generator makes of the models and
+      # endpoints: a model changed without regenerating fails here.
+      - name: Generated code
+        run: |
+          bin="${XDG_STATE_HOME:-$HOME/.local/state}/Dart/install/bin"
+          if ! "$bin/serverpod" --no-analytics version 2>/dev/null | grep -qx "Serverpod version: $SERVERPOD_VERSION"; then
+            dart install "serverpod_cli@$SERVERPOD_VERSION"
+          fi
+          (cd halkyon_learn_server && "$bin/serverpod" --no-analytics generate)
+          if [ -n "$(git status --porcelain)" ]; then
+            git status --short
+            echo 'The generated code differs from what the generator makes now: run `serverpod generate` and commit.' >&2
+            exit 1
+          fi
+
       # The test run mode's passwords, which passwords.yaml holds on a developer's machine
       # and which is never committed. Without them the server tests stop without a word.
       # Throwaway and new for every job: they only guard the test database the job creates