feat(aws/rds): apply SQL migrations on Aurora over the Data API

[xofromthemoon]

AWS.RDS.Aurora now applies SQL migrations on deploy over the RDS Data API, so the deploying machine needs no VPC access or database socket.

const db = yield* AWS.RDS.Aurora("AppDb", {
  subnetIds,
  securityGroupIds,
  migrations: "./migrations", // or a Drizzle.Schema, or { dir, table }
});

Migrations run from the writer DBInstance: once the instance is available, its reconcile applies them over the cluster's Data API. A hand-built cluster declares them on its writer:

const writer = yield* AWS.RDS.DBInstance("Writer", {
  dbClusterIdentifier: cluster.dbClusterIdentifier,
  dbInstanceClass: "db.serverless",
  engine: "aurora-postgresql",
  migrations: "./migrations",
  // migrationsSecretArn defaults to the cluster's RDS-managed master secret
});

It uses the shared migrations pipeline: bookkeeping in __alchemy_migrations, one-way adoption of drizzle-kit/Prisma history, and rejection of rewritten history. Each migration and its bookkeeping row commit in one Data API transaction. Deleting or replacing the instance never touches the database, and a replacement writer finds the existing bookkeeping and applies nothing twice.

The Data API runs one statement per call, so put each statement in its own file or separate them with --> statement-breakpoint (drizzle-kit's default). Declare migrations on one instance per cluster. Aurora rejects migrations combined with dataApi: false. Calls retry DatabaseResumingException while an auto-paused Serverless v2 writer wakes up.

The live test is gated behind AWS_TEST_RDS_DBINSTANCE, because creating and deleting the cluster and writer takes about 15 minutes.