feat: reorder Google Cloud authentication step in staging workflow

[jirhiker]

Why

This PR addresses the following problem / context:

• Use bullet points here

How

Implementation summary - the following was changed / added / removed:

• Use bullet points here

Notes

Any special considerations, workarounds, or follow-up work to note?

• Use bullet points here

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2c2c255ca1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Authenticate before Cloud SQL migrations/backfill

The workflow now runs the Alembic migration (and the backfill step right after it) before google-github-actions/auth, but DB_DRIVER=cloudsql uses the Cloud SQL connector which relies on Application Default Credentials set by that auth step. On GitHub-hosted runners that don’t already have ADC configured, uv run alembic upgrade head and the backfill will fail to open a Cloud SQL connection. Unless these steps are intended to run without GCP auth, the auth step needs to stay before the Cloud SQL actions.

Useful? React with 👍 / 👎.