M1(6-7/8): docker-compose adds fakefcmd + seed sidecar; Dockerfile builds them

- Dockerfile now builds 7 binaries in one image:
  ingestd, routerd, deliverd, admind, seed, loadgen-http, fakefcmd
- docker-compose.yml:
  - fakefcmd service on :8820 with /health
  - deliverd depends on fakefcmd; BA_FAKECMD_URL env points to it
  - seed one-shot sidecar: applies migrations/*.up.sql + seed.sql
    on first start; bind-mounts ./migrations:ro
  - loadgen-http command rewritten as proper flag list
    (--target, --api-key, --mode, --rate, --duration, --metrics)
  - app services 8800-8803, loadgen 8891 (port convention)

Dockerfile

@@ -1,5 +1,5 @@
 # Multi-stage build for broad-announce services.
-# Stage 1: build the four Go service binaries.
+# Stage 1: build the Go service binaries + loadgen + testfakes.
 # Stage 2: tiny alpine with just the binaries + ca-certs.
 
 FROM golang:1.24-alpine AS build
@@ -21,9 +21,14 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
       -o /out/deliverd ./cmd/deliverd && \
     CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" \
       -o /out/admind   ./cmd/admind && \
+    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" \
+      -o /out/seed     ./cmd/seed && \
     cd loadgen && \
     CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" \
-      -o /out/loadgen-http ./cmd/http
+      -o /out/loadgen-http ./cmd/http && \
+    cd .. && \
+    CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" \
+      -o /out/fakefcmd ./testfakes/fakefcmd
 
 FROM alpine:3.20
 RUN apk add --no-cache ca-certificates

docker-compose.yml

@@ -102,9 +102,32 @@ services:
       BA_HTTP_ADDR: ":8802"
       BA_NATS_URL: nats://nats:4222
       BA_POSTGRES_DSN: postgres://ba:ba@postgres:5432/ba?sslmode=disable
+      BA_FAKECMD_URL: "http://fakefcmd:8820"
     ports: ["8802:8802"]
     depends_on:
-      nats:     { condition: service_healthy }
+      nats:      { condition: service_healthy }
+      postgres:  { condition: service_healthy }
+      fakefcmd:  { condition: service_started }
+
+  fakefcmd:
+    build: .
+    command: ["/app/fakefcmd", "--addr", ":8820"]
+    ports: ["8820:8820"]
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8820/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  seed:
+    build: .
+    command: ["/app/seed"]
+    environment:
+      BA_POSTGRES_DSN: postgres://ba:ba@postgres:5432/ba?sslmode=disable
+      BA_MIGRATIONS_DIR: /migrations
+    volumes:
+      - ./migrations:/migrations:ro
+    depends_on:
       postgres: { condition: service_healthy }
 
   admind:
@@ -138,15 +161,17 @@ services:
       GF_SECURITY_ADMIN_PASSWORD: admin
     depends_on: [prometheus]
 
-  # ── Loadgen (one-shot smoke profile) ─────────────────────────────
+  # ── Loadgen (one-shot smoke profile) ────────────────────
   loadgen-http:
     build: .
-    command: ["/app/loadgen-http"]
-    environment:
-      BA_TARGET: http://ingestd:8800
-      BA_API_KEY: "acme-001:prom-prod:s3cret-acme"
-      BA_RATE: "50"
-      BA_DURATION: "30s"
+    command:
+      - /app/loadgen-http
+      - --target=http://ingestd:8800
+      - --api-key=acme-001:prom-prod:s3cret-acme
+      - --mode=normal
+      - --rate=50
+      - --duration=30s
+      - --metrics=:8891
     profiles: ["loadgen"]
     depends_on:
       ingestd: { condition: service_started }