Build every database's schema from embedded SQL files (closes #56)

The main database, each webhook's event database and each archive file
get their schema from SQL files under internal/db/migrations/, one
directory per kind. Opening a file runs, in one transaction, each file
that schema_migrations does not list. GORM stays for queries.
AutoMigrate is gone, tests included.

An event database holds only its own tables now, so the sweep that
removed target rows copied into it is deleted. The association guard
stays: without it a delivery write fails on the missing targets table.

AutoMigrate also had GORM parse every model before a handle was shared.
That is now done on its own: GORM races when two goroutines first use
models that refer to each other.

Model: opus-5-5

internal/gormlog/scan_guard_test.go

@@ -115,8 +115,8 @@ func skipDir(name string) bool {
 }
 
 // walkNonTestGo parses every non-test .go file under root. It returns
-// the directories, relative to root, it parsed a file in, along with
-// every unguarded Scan it found.
+// the directories, relative to root, it parsed a file in or below,
+// along with every unguarded Scan it found.
 func walkNonTestGo(t *testing.T, root string) (map[string]bool, []string) {
 	t.Helper()
 
@@ -155,7 +155,12 @@ func walkNonTestGo(t *testing.T, root string) (map[string]bool, []string) {
 				return err
 			}
 
-			walked[dir] = true
+			// The directories above count too, so that one holding
+			// only a nested package, as internal/db does, is not
+			// taken for one the walk skipped.
+			for ; dir != "."; dir = filepath.Dir(dir) {
+				walked[dir] = true
+			}
 
 			for _, pos := range unguardedScans(fset, file) {
 				hits = append(hits, relPosition(root, pos))
@@ -205,9 +210,9 @@ func TestGormScanIsNeverCalledOutsideTests(t *testing.T) {
 	walked, offenders := walkNonTestGo(t, root)
 
 	// The module's packages are static, templates, and every directory
-	// directly under cmd and internal. Each holds non-test code, so one
-	// the walk parsed nothing in was skipped, and a Scan there would
-	// pass unseen.
+	// directly under cmd and internal. Each holds non-test code, itself
+	// or in a package below it, so one the walk parsed nothing in or
+	// below was skipped, and a Scan there would pass unseen.
 	packages := []string{"static", "templates"}
 
 	for _, parent := range []string{"cmd", "internal"} {