From the Rodauth docs:
While the
appaccount is not be able to read password hashes, it is still be able to insert password hashes, update passwords hashes, and delete password hashes, so the additional security is not that painful.
So, this is role separation within a single database. Using a separate gateway config is the wrong approach here, because that assumes that the gateways are connecting to different DBs. There is only one config dir with one set of migrations per database in the ROM integration.
My recommendation would be to create three roles in your database: a migration role with superuser access to everything, an app role, and a ph role.