refactor: replace universal_migration.py with Alembic

Remove the 7,791-line universal_migration.py and 16 incomplete individual
Alembic migrations. Replace with a single initial schema migration using
Base.metadata.create_all(checkfirst=True).

Changes:
- Add programmatic Alembic runner (app/database/migrations.py) with
  auto-stamp logic for existing databases transitioning from
  universal_migration
- Extract ensure_default_web_api_token() to web_api_token_service.py
- Extract sync_postgres_sequences() to database.py with SQL injection
  prevention via _quote_ident()
- Add HMAC token hashing support with backward-compatible dual-hash
  fallback and automatic rehashing
- Remove dead init_db() function and unused imports
- Add Makefile targets: migrate, migration, migrate-stamp, migrate-history
- Fix fileConfig() destroying structlog config (disable_existing_loggers)
- Remove duplicate migrations/alembic/alembic.ini with credentials
- Add script.py.mako template for future migration generation
- Update startup flow: alembic upgrade → sync sequences → ensure token
- Harden database.py: ParamSpec for retry decorator, safe URL logging,
  echo='debug' mode, execute_with_retry validation
- Update documentation references

31 files changed, 302 insertions(+), 9,226 deletions(-)

migrations/alembic/env.py

@@ -17,11 +17,13 @@ from app.config import settings
 config = context.config
 
 if config.config_file_name is not None:
-    fileConfig(config.config_file_name)
+    fileConfig(config.config_file_name, disable_existing_loggers=False)
 
 target_metadata = Base.metadata
 
-config.set_main_option("sqlalchemy.url", settings.DATABASE_URL)
+# URL also set in app/database/migrations.py for programmatic usage;
+# this line is needed for CLI invocation (make migrate, make migration).
+config.set_main_option("sqlalchemy.url", settings.get_database_url())
 
 
 def run_migrations_offline() -> None:
@@ -58,6 +60,10 @@ async def run_async_migrations() -> None:
 
 
 def run_migrations_online() -> None:
+    # asyncio.run() is safe here: when called programmatically via
+    # run_alembic_upgrade(), this runs inside run_in_executor() which
+    # creates a separate thread with no event loop, so asyncio.run()
+    # can create a fresh loop without conflict.
     asyncio.run(run_async_migrations())