feat(scripts): remote migrate-storage script for MinIO to filesystem migration

Adds scripts/migrate-storage.sh that follows the same deploy.sh pattern:
cross-compiles the migrate-storage binary locally, uploads it to the
target host via SCP, then runs it over SSH using credentials from
/etc/silo/silod.env.

Usage: ./scripts/migrate-storage.sh <silo-host> <psql-host> <minio-host> [flags...]

scripts/migrate-storage.sh

@@ -0,0 +1,108 @@
+#!/bin/bash
+# Migrate storage from MinIO to filesystem on a remote Silo host.
+#
+# Builds the migrate-storage binary locally, uploads it to the target host,
+# then runs it over SSH using credentials from /etc/silo/silod.env.
+#
+# Usage: ./scripts/migrate-storage.sh <silo-host> <psql-host> <minio-host> [flags...]
+#
+# Examples:
+#   ./scripts/migrate-storage.sh silo.kindred.internal psql.kindred.internal minio.kindred.internal -dry-run -verbose
+#   ./scripts/migrate-storage.sh silo.kindred.internal psql.kindred.internal minio.kindred.internal
+
+set -euo pipefail
+
+if [ $# -lt 3 ]; then
+    echo "Usage: $0 <silo-host> <psql-host> <minio-host> [flags...]"
+    echo "  flags are passed to migrate-storage (e.g. -dry-run -verbose)"
+    exit 1
+fi
+
+TARGET="$1"
+DB_HOST="$2"
+MINIO_HOST="$3"
+shift 3
+EXTRA_FLAGS="$*"
+
+DEST_DIR="/opt/silo/data"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="${SCRIPT_DIR}/.."
+
+echo "=== Migrate Storage: MinIO -> Filesystem ==="
+echo "  Target:  ${TARGET}"
+echo "  DB host: ${DB_HOST}"
+echo "  MinIO:   ${MINIO_HOST}"
+echo "  Dest:    ${DEST_DIR}"
+[ -n "$EXTRA_FLAGS" ] && echo "  Flags:   ${EXTRA_FLAGS}"
+echo ""
+
+# --- Build locally ---
+echo "[1/3] Building migrate-storage binary..."
+cd "$PROJECT_DIR"
+GOOS=linux GOARCH=amd64 go build -o migrate-storage ./cmd/migrate-storage
+echo "  Built: $(du -h migrate-storage | cut -f1)"
+
+# --- Upload ---
+echo "[2/3] Uploading to ${TARGET}..."
+scp migrate-storage "${TARGET}:/tmp/migrate-storage"
+rm -f migrate-storage
+
+# --- Run remotely ---
+echo "[3/3] Running migration on ${TARGET}..."
+ssh "$TARGET" DB_HOST="$DB_HOST" MINIO_HOST="$MINIO_HOST" DEST_DIR="$DEST_DIR" EXTRA_FLAGS="$EXTRA_FLAGS" bash -s <<'REMOTE'
+set -euo pipefail
+
+CONFIG_DIR="/etc/silo"
+
+# Source credentials
+if [ ! -f "$CONFIG_DIR/silod.env" ]; then
+    echo "ERROR: $CONFIG_DIR/silod.env not found on $(hostname)"
+    exit 1
+fi
+set -a
+source "$CONFIG_DIR/silod.env"
+set +a
+
+# Ensure destination directory exists
+sudo mkdir -p "$DEST_DIR"
+sudo chown silo:silo "$DEST_DIR" 2>/dev/null || true
+
+chmod +x /tmp/migrate-storage
+
+# Write temporary config with the provided hosts
+cat > /tmp/silo-migrate.yaml <<EOF
+database:
+  host: "${DB_HOST}"
+  port: 5432
+  name: "silo"
+  user: "silo"
+  password: "${SILO_DB_PASSWORD}"
+  sslmode: "require"
+  max_connections: 5
+
+storage:
+  endpoint: "${MINIO_HOST}:9000"
+  access_key: "${SILO_MINIO_ACCESS_KEY}"
+  secret_key: "${SILO_MINIO_SECRET_KEY}"
+  bucket: "silo"
+  use_ssl: false
+  region: "us-east-1"
+EOF
+chmod 600 /tmp/silo-migrate.yaml
+
+echo "  Config written to /tmp/silo-migrate.yaml"
+echo "  Starting migration..."
+echo ""
+
+# Run the migration
+/tmp/migrate-storage -config /tmp/silo-migrate.yaml -dest "$DEST_DIR" $EXTRA_FLAGS
+
+# Clean up
+rm -f /tmp/silo-migrate.yaml /tmp/migrate-storage
+echo ""
+echo "  Cleaned up temp files."
+REMOTE
+
+echo ""
+echo "=== Migration complete ==="
+echo "  Files written to ${TARGET}:${DEST_DIR}"