[Jasonxia007]

Account upgrades no longer require Python, pip or jq on the deployment host. Bash owns Docker/kubectl orchestration; the existing backend image runs the database-only Python worker in a one-shot Docker container or Kubernetes Job. Package the worker and account SQL together and bypass application startup.

Keep the account-table completion rule and distinguish fresh targets from legacy membership databases. Run the migration before application SQL, Secret replacement and rollout. Failure rolls back the account/schema transaction and retains the source. Reclaim source DB/Auth/Kong only after explicit commit confirmation; preserve storage/backups and clean up owned workers, Jobs and temporary Secrets. Docker handles separate source/target networks. Kubernetes preserves PVC/PV definitions, sets Retain and disables the worker API-token mount.

Update the shared deployment entry, manual recovery/preview instructions, image packaging and regression tests. Existing public authentication contracts and account classification remain unchanged.

Validation:

• 96 focused Python unit tests passed on the latest develop baseline.
• Real PostgreSQL/Docker D5 passed 22 tests, including failing host-Python shims, separate networks, entrypoint bypass, conflict rollback, preview/retry and successful cleanup.
• Real docker-desktop Kubernetes Job verification passed in an isolated namespace, including source scale-up, rollback, preview, apply, retained PVCs, completed rerun and temporary Secret/Job cleanup. The test fixture injects code/dependencies; production packages them in the backend image.
• Five deployment/image Shell suites and strict acceptance/preparation/UT-change asset validation passed.
• Full backend dependency image rebuild and external CAS/OAuth journeys were not executed.