refactor: switch to versioned migrations runner (phases 2+3)

- migrate.js → legacy-migrate.js (kept for rollback, delete 2026-07-01)
- tests/setup.js now uses migrations-runner.run() on fresh temp DB
- npm run migrate → versioned runner (was legacy init-every-start)
- npm run migrate:legacy → legacy-migrate.js (emergency rollback only)

After `npm run migrate:bootstrap` on prod:
  npm run migrate → "Nothing to apply — schema is up to date"

All 32 previously-passing tests continue to pass.
Pre-existing 3 auth.test.js failures (rate-limiter shared state) unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/setup.js

@@ -15,7 +15,7 @@ process.env.NODE_ENV   = 'test';
 
 // Now require app modules (they will use the temp DB)
 const db = require('../src/db/db');
-require('../src/db/migrate');
+require('../src/db/migrations-runner').run();
 
 // Seed permissions
 const { seedDefaults } = require('../src/controllers/permissionsController');