feat(sqlx): update mise task and migration documentation

- Rename test:rust to test:sqlx for clarity
- Implement hybrid migration approach in mise task
- Document hybrid migration strategy in migrations README
- Auto-copy built EQL to migrations on test run

Author: tobyhede

tasks/rust.toml

@@ -1,16 +1,31 @@
-["test:rust"]
-description = "Run Rust test framework"
-dir = "{{config_root}}/tests/sqlx"
+["test:sqlx"]
+description = "Run SQLx tests with hybrid migration approach"
+dir = "{{config_root}}"
+env = { DATABASE_URL = "postgresql://{{get_env(name='POSTGRES_USER', default='cipherstash')}}:{{get_env(name='POSTGRES_PASSWORD', default='password')}}@{{get_env(name='POSTGRES_HOST', default='localhost')}}:{{get_env(name='POSTGRES_PORT', default='7432')}}/{{get_env(name='POSTGRES_DB', default='cipherstash')}}" }
 run = """
-# Ensure database is running
+# Build EQL SQL from source
+echo "Building EQL SQL..."
+mise run build --force
+
+# Copy built SQL to SQLx migrations (EQL install is generated, not static)
+echo "Updating SQLx migrations with built EQL..."
+cp release/cipherstash-encrypt.sql tests/sqlx/migrations/001_install_eql.sql
+
+# Ensure PostgreSQL is running
+echo "Starting PostgreSQL..."
 mise run postgres:up --extra-args "--detach --wait"
 
-# Run tests
+# Run SQLx migrations and tests
+echo "Running SQLx migrations..."
+cd tests/sqlx
+sqlx migrate run
+
+echo "Running Rust tests..."
 cargo test
 """
 
-["test:rust:watch"]
-description = "Run Rust tests in watch mode"
+["test:sqlx:watch"]
+description = "Run SQLx tests in watch mode (rebuild EQL on changes)"
 dir = "{{config_root}}/tests/sqlx"
 run = """
 cargo watch -x test

tests/sqlx/migrations/README.md

@@ -1,15 +1,42 @@
 # SQLx Migrations
 
-These migrations install EQL and test helpers into the test database.
+These migrations install EQL and test helpers into the test database using a **hybrid approach**.
 
-**Important**: SQLx tracks migration state. When using `#[sqlx::test]`:
+## Hybrid Migration Approach
+
+**Migration 001 is generated**, not static:
+- Built from `src/` using `mise run build`
+- Automatically copied to `migrations/001_install_eql.sql` by `mise run test:sqlx`
+- In `.gitignore` - never commit this file
+- Ensures tests always use current EQL version
+
+**Migrations 002-004 are static fixtures**:
+- 002: Test helpers (`test_helpers.sql`)
+- 003: ORE test data (`ore.sql`)
+- 004: STE Vec test data (`ste_vec.sql`)
+
+## How SQLx Uses These Migrations
+
+When using `#[sqlx::test]`:
 - Each test gets a fresh database
-- Migrations run automatically before each test
+- All migrations (001-004) run automatically before each test
+- Migration 001 contains the latest built EQL
 - No need to manually reset database between tests
 
-To regenerate migrations:
+## When to Manually Regenerate
+
+**You usually don't need to regenerate** - the `test:sqlx` task handles it automatically.
+
+Only regenerate manually if debugging migration issues:
 ```bash
 mise run build
 cp release/cipherstash-encrypt.sql tests/sqlx/migrations/001_install_eql.sql
-cp tests/test_helpers.sql tests/sqlx/migrations/002_install_test_helpers.sql
 ```
+
+## Adding New Test Fixtures
+
+To add new test data or helpers:
+1. Create a new migration: `tests/sqlx/migrations/005_my_fixture.sql`
+2. Add your SQL fixtures
+3. Commit it (static migrations are version-controlled)
+4. SQLx will apply it automatically in test runs