fix: unify goose Provider path and fail on pending migrations

Apply BasePath via fs.Sub, route CLI through Provider API, return
ErrPendingMigrations when auto-migrate is disabled, use DownTo for blank.

Co-authored-by: Cursor <cursoragent@cursor.com>

provider.go

@@ -0,0 +1,36 @@
+package migrate
+
+import (
+	"fmt"
+
+	"gitea.auvem.com/go-toolkit/app"
+	"github.com/pressly/goose/v3"
+)
+
+func setupMigrations(mod *app.Module) error {
+	cfg := migrationsConfig
+	mfs, err := migrationFS(cfg)
+	if err != nil {
+		return fmt.Errorf("migration filesystem: %w", err)
+	}
+
+	provider, err := goose.NewProvider(cfg.Dialect, cfg.SQLO(), mfs)
+	if err != nil {
+		migrationsModule.Logger().Error("Couldn't initialize goose migration provider", "err", err)
+		return err
+	}
+	migrationProvider = provider
+	mod.Logger().Info("Goose migration provider initialized",
+		"dialect", cfg.Dialect,
+		"basePath", cfg.BasePath,
+	)
+	return nil
+}
+
+// Provider returns the initialized goose provider.
+func Provider() (*goose.Provider, error) {
+	if migrationProvider == nil {
+		return nil, ErrNotInitialized
+	}
+	return migrationProvider, nil
+}