Normalize database changes: verified baseline, SQL migration files, no more push - #215

Removed: db-prepare (drizzle-kit generate + push against PROD_DATABASE_URL).
Against a copy of production, push wanted to drop the four
*_merge_backup_20260929 tables and the two hand-made indexes, and to drop and
re-add three identical unique constraints (a drizzle-kit 0.31 bug).

Removed: the drizzle-kit export-based local schema. It missed the IMAP
triggers and hand-made indexes. scripts/local-dev/services.ts now applies
drizzle/migrations to the local Docker database (dev:local and test:e2e).

New scripts (scripts/db/, using drizzle-orm's node-postgres migrator and the
existing pg dependency):
- db:generate: drizzle-kit generate (pass --name / --custom).
- db:check: drizzle-kit check, journal/file consistency, and a generate into
  a temp copy that fails if schema.ts changed without a migration. Needs no
  database and does not modify the repo.
- db:migrate:local [db]: apply to the local Docker Postgres.
- db:migrate:preview [branch]: pull the branch's Vercel Preview
  DATABASE_URL_UNPOOLED into a 0600 temp file (deleted after, never printed),
  refuse if it matches the production host (PROD_DATABASE_HOST /
  PROD_DATABASE_URL / Vercel production values; fails closed if none), apply.
- db:migrate:prod: requires PROD_DATABASE_URL, prints host and pending
  migrations, requires typing the host or --yes.
- db:baseline:prod / db:baseline:preview: one-time, records 0000 and 0001 in
  drizzle.__drizzle_migrations with the same hash (sha256 of the file) and
  created_at (journal when) drizzle's migrator writes. Dry run by default;
  refuses a non-empty table or a target missing any baseline column, index,
  enum value or IMAP trigger; --apply writes in a transaction.
The runner refuses databases that have tables but no recorded migrations,
and migrations older than the last applied one that are not recorded (edited
or generated on an older base), which drizzle's migrator would skip silently.

Verified on a throwaway Postgres 17: production's schema dump (no data) ->
baseline dry run -> --apply -> rows identical to a migrator-built database ->
db:migrate:prod reports nothing pending -> a dummy 0002 in a temp copy is the
only pending migration and applies. Refusal paths checked (missing objects,
non-empty table, edited migration, export-built database, preview host equal
to production). bun run test:e2e: 23 pass before and after; the e2e database
now has the 4 triggers and both indexes.

- CI: the unit job runs bun run db:check (no database needed).
- AGENTS.md: replace "prompt the user to run drizzle-kit generate/push" and
  "don't run drizzle-kit commands" with a Database Changes section: schema.ts
  is the source of truth, every change ships as a numbered, reviewed SQL
  migration, never edit applied migrations, never push or export, apply to
  preview then production before deploying dependent code, additive first,
  production is applied by the user. Notes that pending migrations run in one
  transaction, so CREATE INDEX CONCURRENTLY can't be in a migration.
- scripts/cleanup-duplicate-deliveries.ts no longer tells you to run
  drizzle-kit push.

Verified: bun run db:check passes and fails when a column is added to
schema.ts without a migration.

- PROD_DATABASE_HOST accepts a bare host or a URL, strips the port and the
  Neon -pooler suffix, and rejects anything still containing / : or @. All
  production/preview host comparisons use the same normalisation.
- Preview resolution also pulls the environment-wide Preview values; if the
  branch's database host equals the shared one (vercel env pull falls back
  when a branch has no scoped vars), refuse unless --allow-shared-preview.
  The checks live in checkPreviewDatabase so they can be exercised without
  Vercel.
- Baseline verification also checks PK, unique and FK constraint names from
  the snapshot against pg_constraint. A target without the IMAP triggers now
  records only 0000 and leaves the idempotent 0001 pending for db:migrate,
  so export-built local databases can be baselined.
- db:baseline:local added; the "tables but no history" error points to the
  baseline commands.
- db:migrate fails on edited/unrecorded older migrations right after reading
  status, before any prompt, even when nothing is pending.
- Prod confirmation takes --yes=<host>; bare --yes is rejected.
- applyMigrations holds a session-level pg_advisory_lock around drizzle's
  migrator (which opens its own transaction); baseline takes
  pg_advisory_xact_lock in its transaction.
- drizzle.config.ts has no dbCredentials, so drizzle-kit push/pull/studio
  fail closed; generate and check do not need a database.
- AGENTS.md: enum ADD VALUE trap, db:baseline:preview for preview branches
  forked before the baseline, "no raw SQL" scoped to application code.

Verified on throwaway Postgres 17: prod schema dump (read-only) baseline dry
run and --apply with --yes=<host> (bare and wrong --yes refused), then
nothing pending; a copy missing a unique constraint and an FK is refused
with both listed; an edited applied migration fails before any prompt; 3
concurrent applyMigrations apply once; export-built DB baselines 0000 and
db:migrate applies 0001. Host guards checked with mocked env values.
Scoped tsc over the changed files: 0 errors. db:check passes,
test:unit 185 pass, test:e2e 23 pass.