Add db migration and DNS dmarc entries

README.md

@@ -26,6 +26,8 @@ nano config/config.yml
 docker compose up -d --build
 ```
 
+Container startup runs `alembic upgrade head` before starting the dashboard, so mounted SQLite databases are migrated forward automatically when new schema migrations are added.
+
 Then process the existing mailbox backlog:
 
 ```bash
@@ -115,6 +117,30 @@ Options:
 
 Backlog mode scans all matching messages, skips already imported XML hashes unless `--reprocess` is passed, and does not modify messages unless configured or explicitly flagged.
 
+## Database Migrations
+
+Schema changes are managed with Alembic. In Docker, migrations run automatically on container startup:
+
+```bash
+docker compose up -d --build
+```
+
+For a manual migration run:
+
+```bash
+docker compose exec dmarc-sentinel alembic upgrade head
+```
+
+For local development:
+
+```bash
+DMARC_SENTINEL_ALLOW_NO_LLM_FOR_TESTS=true alembic upgrade head
+```
+
+The app still creates missing tables on startup for lightweight local and test runs, but migrations are the intended path for preserving an existing production SQLite database.
+
+When adopting Alembic on an existing database that was already started once with the new code, the migration is idempotent for the DNS snapshot table and will still stamp the Alembic revision.
+
 ## gethomepage Widget
 
 Endpoint: