refactor: switch to versioned migrations runner (phases 2+3)

- migrate.js → legacy-migrate.js (kept for rollback, delete 2026-07-01)
- tests/setup.js now uses migrations-runner.run() on fresh temp DB
- npm run migrate → versioned runner (was legacy init-every-start)
- npm run migrate:legacy → legacy-migrate.js (emergency rollback only)

After `npm run migrate:bootstrap` on prod:
  npm run migrate → "Nothing to apply — schema is up to date"

All 32 previously-passing tests continue to pass.
Pre-existing 3 auth.test.js failures (rate-limiter shared state) unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/db/legacy-migrate.js

@@ -1,3 +1,7 @@
+// LEGACY: monolithic init-on-every-start migration. Do not use directly.
+// Schema is now managed via migrations-runner.js + migrations/NNN_*.sql
+// New schema changes → add migrations/NNN_description.sql, run `npm run migrate`
+// This file kept for rollback reference. Delete after 2026-07-01 if stable.
 const db = require('./db');
 
 db.exec(`