feat(db): pre-migration SQLite snapshots via VACUUM INTO

Take a consistent, atomic copy of the DB at lifespan startup BEFORE
migrations run, so a botched future upgrade is recoverable by restoring
a single file instead of a data-loss incident.

Uses SQLite's VACUUM INTO — safe under WAL, cannot tear against
concurrent writes. Best-effort: failures are logged, never raised —
the main DB remains the source of truth.

Configurable via NOTIFY_BRIDGE_PRE_MIGRATE_SNAPSHOT_KEEP (default 5;
0 disables). Snapshots land in ``data_dir/backups/pre-migrate-<ts>.db``
and the N oldest are pruned each boot.

packages/server/src/notify_bridge_server/main.py

@@ -77,7 +77,16 @@ async def lifespan(app: FastAPI):
         migrate_performance_indexes,
         migrate_schema_version,
     )
+    from .database.snapshot import snapshot_and_prune
     engine = get_engine()
+    # Take a consistent DB snapshot BEFORE migrations run, so operators can
+    # roll back a bad upgrade by restoring one file. Best-effort — failures
+    # are logged, not raised.
+    await snapshot_and_prune(
+        engine,
+        _log_cfg.data_dir / "backups",
+        keep=_log_cfg.pre_migrate_snapshot_keep,
+    )
     await migrate_schema(engine)
     await migrate_tracker_targets(engine)
     await migrate_entity_refactor(engine)