Add transactional database migration system

[RANGROO]

Summary

• add a native PostgreSQL migration runner with global ordering, advisory locking, per-migration transactions, checksums, gap/drift detection, and an append-only chim_meta.schema_migrations ledger
• establish an audited 202608110000 legacy baseline plus generated baseline/current schema contracts
• freeze debug/db_updates.php as an explicit compatibility bridge and remove schema writes from normal UI/game request paths
• move the unversioned audit_request.response DDL into the first raw SQL migration
• make fresh install and database test setup run the legacy bridge, migrations, and verification
• add operator/generator commands and migration authoring documentation

Baseline transition

The compatibility repair reasserts two structures that the legacy latest-per-feature markers or process-static state can hide (visual_context and the prompts unique index). It also upgrades eventlog.sess transactionally while discovering, rebuilding, and owner-preserving every dependent profile view. It refuses profile views with custom grants/options rather than silently losing them.

Normal runtime requests now compare every source migration version, name, and SHA-256 checksum to the ledger. Stale or drifted databases fail closed with the operator bridge command; runtime requests do not execute DDL.

Validation

• PHP lint: all 17 changed/new PHP files passed
• focused PHPUnit: MigrationRunnerTest passed, 4 tests / 8 assertions
  • idempotence
  • structural drift detection
  • checksum drift rejection
  • failed migration transaction/ledger rollback
• fresh database: imported database_default.sql, ran frozen updater + audited repair, applied migration, verified current schema, and confirmed second migrate was a no-op
• real upgrade shape: restored a dump of the local user database into an isolated database, upgraded it, and verified all three eventlog.sess dependent views remained present with their owners
• concurrency: two simultaneous runners both succeeded; migration table and ledger row were created exactly once
• runtime gate: a corrupted ledger checksum was rejected and CLI runtime failed closed
• local deployment: deployed exact commit 21b9c3152e770606bd04c7b7c2817f24c80ec51f to the DwemerAI4Skyrim3 HerikaServer runtime after a 198,783,649-byte compressed backup
• deployed database: status, verify, and doctor passed; eventlog.sess is text; audit_request.response exists
• HTTP smoke: index, home, STT, ITT, and TTS pages returned 200; the ledger hash was unchanged across requests
• preservation audit: restored the exact pre-deploy backup and compared 263 pre-existing tables (203 non-empty); no row-count decreases

Full-suite limits

The full PHPUnit invocation ran 261 tests / 2,635 assertions before ending non-green. It exposed the repository's existing duplicate sql test-class architecture and unrelated existing assertions in faction ordering and historic-context behavior. The migration-specific suite is green; this PR does not claim the entire legacy suite is green.

Review / overlap

The unstable guard returned PR_REQUIRED for size, generated contract growth, sensitive lifecycle code, and recent/open work overlap. In particular, debug/db_updates.php overlaps open PRs #690, #594, and #536. This PR only freezes the file and changes the eventlog_session_payload handoff/removes the unversioned audit DDL; historical feature blocks are not rewritten.

Deployment scope

HerikaServer only. No CHIM DLL was rebuilt or deployed. No release/version bump was made.

[RANGROO]

Superseded by consolidated draft #701, which contains this work plus the completed Oghma catalog, retrieval, knowledge-class, biography, parity, and UI changes. Please review the combined draft there.