feat(migrations): replay idempotent SQL files instead of a checksum ledger

[TheGreatAxios]

Summary

• Stacked on test: e2e for SSE live delivery, isolation and purge #44.
• Migrations ship as migrations/*.sql (added to files). runMailboxMigrations replays every file in filename order on each run under an advisory lock, the way Interchange runMigrations and @corbits/memory do. The embedded SQL, migrationChecksum and MigrationChecksumError are deleted.
• Every column, index and backfill is guarded on the catalog in a DO block. A replay rewrites no row and takes no principal_mail/mailbox_state lock that blocks mail reads or writes.
• 0004 seeds mailbox_state only when it creates the table, and copies each message's folder and \Seen from a pre-0.1.0 "mailbox"."mailbox" table before 0005 drops it. Because every file replays on each boot, 0005 drops "mailbox"."mailbox" only when its columns are exactly the pre-0.1.0 set, and 0007 drops the ledger only when it has exactly the 0.1.0 columns, so a host's own table under either name survives. 0005 sets uid and modseq NOT NULL, each only while nullable. 0001 no longer creates the pre-native "mailbox"."mailbox" table.
• 0007_drop_migrations_ledger.sql drops "mailbox"."corbits_mailbox_migrations". A 0.1.0 database upgrades on its next boot with no manual step.
• CHANGELOG, ARCHITECTURE and CONTRIBUTING describe the upgrade path.
• The README follows the Corbits README standard, lists each route's grant, and has an upgrade section for 0.1 hosts.
• An eslint directive is dropped from src/db.ts (the repo has no eslint).

Verification

• tests/upgrade-from-0.1.0.test.ts: migrates with the published @corbits/mailbox@0.1.0 runner (a devDependency alias), writes mail through 0.1.0's persist, folder move and a \Seen flag, then runs the new runner twice. Every row, column and index stays identical, and the ledger is gone.
• A migration test rebuilds a pre-0.1.0 database and asserts folder and \Seen survive for read, archived, trashed and untouched rows.
• A migration test plants a host-owned "mailbox"."mailbox" (the seven pre-0.1.0 state columns plus one of its own) and "mailbox"."corbits_mailbox_migrations", replays, and asserts both survive.
• Lock regression test: a replay succeeds with lock_timeout = 2s while another transaction holds ROW EXCLUSIVE on both tables.
• npm pack --dry-run lists all 7 SQL files.
• CI is green on this branch: install --frozen-lockfile, build, typecheck, tests against Postgres, and the Node consumer smoke test.

Closes CL-9243

[TheGreatAxios]

Self-review: an independent critique pass found a lock regression, where replayed ADD COLUMN/CREATE INDEX took AccessExclusive/Share locks. Fixed with catalog guards and covered by a lock_timeout test. Stale ledger docs and comments are also fixed. Out of scope: databases built by code older than 0.1.0 (with principal_mail but no uid) are not supported. The 0.1.0 runner always applied all six migrations atomically.