feat: versioned migrations runner (phase 1 — no behaviour change)

Adds backend/src/db/migrations-runner.js:
- Tracks applied migrations in _migrations table
- Applies .sql files from src/db/migrations/ in alphabetical order
- Each file runs in a transaction — fail-fast, no partial state
- `migrate:bootstrap` marks 000_baseline.sql as applied on existing DBs

000_baseline.sql — full schema snapshot from prod DB (168 objects, 2026-05-06).
Removed stale PostgreSQL migration files (001_init.sql, 002_constraints.sql)
that used SERIAL/EXTENSION syntax incompatible with SQLite.

npm scripts:
  migrate           → migrations-runner.js (versioned)
  migrate:bootstrap → mark baseline applied (run once per env)
  migrate:legacy    → legacy migrate.js (kept for reference)

On prod DB after `migrate:bootstrap`: "Nothing to apply — schema is up to date".
Legacy migrate.js still in place; tests still use it via setup.js (unchanged).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/package.json

@@ -6,7 +6,9 @@
   "scripts": {
     "start": "node src/server.js",
     "dev": "nodemon src/server.js",
-    "migrate": "node src/db/migrate.js",
+    "migrate": "node src/db/migrations-runner.js",
+    "migrate:bootstrap": "node src/db/migrations-runner.js bootstrap",
+    "migrate:legacy": "node src/db/migrate.js",
     "seed": "node src/db/seed.js",
     "seed:permissions": "node src/db/seed-permissions.js",
     "lint:routes": "node scripts/check-route-auth.js",