[DB migration] Leveraging tools for DB migration

[aldbr]

Why this issue exists

python -m diracx.db init-sql calls metadata.create_all, which creates missing tables and never
alters an existing one. Any change to a table that already exists on a deployed installation has to be
applied by hand, from instructions in a PR description. Nothing records whether it was applied.

Until Alembic lands, every PR that modifies a schema.py for an already-released table is a latent
production incident. This issue tracks the work to fix that, and the PRs held behind it.

Supersedes #580 (Alembic triggers), which demonstrated the tool works but stalled on the scope questions
the ADR should now answer.

PRs held behind this

• chore: token policies persisted in DB #967 — token policies persisted in DB. Adds Policies to RefreshTokens; requires
  ALTER TABLE RefreshTokens ADD COLUMN Policies JSON on every existing installation, and hard-fails
  token issuance if it was not run. Already expand-shaped (nullable column; the code falls back to
  recomputing from all_access_policies on NULL), so it becomes the first real revision once the
  setup PR lands. Agreed: not merged before then.