stela ops usage fixes roles propagation and timoeut, one account to support multi tenants, migrations consolidation, search to support documentation, doctor and open api vector db search

devops/compose/docker-compose.dev.yml

@@ -13,7 +13,7 @@
 #   - PostgreSQL 18.1 on 127.1.1.1:5432 (db.stella-ops.local)
 #   - Valkey 9.0.1 on 127.1.1.2:6379 (cache.stella-ops.local)
 #   - SeaweedFS (S3) on 127.1.1.3:8333 (s3.stella-ops.local)
-#   - Rekor v2 (tiles) on 127.1.1.4:3322 (rekor.stella-ops.local, opt-in sigstore profile)
+#   - Rekor v2 (tiles) on 127.1.1.4:3322 (rekor.stella-ops.local, opt-in sigstore-local profile)
 #   - Zot (OCI registry) on 127.1.1.5:80 (registry.stella-ops.local)
 # =============================================================================
 
@@ -70,14 +70,32 @@ services:
   rekor-v2:
     image: ${REKOR_TILES_IMAGE:-ghcr.io/sigstore/rekor-tiles:latest}
     container_name: stellaops-dev-rekor
-    restart: unless-stopped
-    profiles: ["sigstore"]
+    restart: on-failure:5
+    command:
+      - rekor-server
+      - serve
+      - --http-address
+      - 0.0.0.0
+      - --http-port
+      - "3322"
+      - --grpc-address
+      - 0.0.0.0
+      - --grpc-port
+      - "3323"
+      - --signer-filepath
+      - /etc/rekor/signer.pem
+      - --gcp-bucket
+      - ${REKOR_GCP_BUCKET:-stellaops-rekor-dev}
+      - --gcp-spanner
+      - ${REKOR_GCP_SPANNER:-projects/stellaops-dev/instances/rekor/databases/rekor}
+    profiles: ["sigstore-local"]
     volumes:
       - rekor-tiles-data:/var/lib/rekor-tiles
+      - ../../etc/authority/keys/signing-dev.pem:/etc/rekor/signer.pem:ro
     ports:
       - "127.1.1.4:${REKOR_PORT:-3322}:3322"
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3322/healthz"]
+      test: ["CMD", "curl", "-f", "http://localhost:3322/api/v1/log"]
       interval: 30s
       timeout: 10s
       retries: 3