Reconcile schema drift between prod, migrations, and models

[bencap]

Problem

alembic upgrade head against an empty database does not reproduce prod's schema. Some models predate the migration chain and table hygiene was inconsistent. Three schemas currently disagree:

1. prod, by historical accretion
2. migrations-from-empty
3. Base.metadata via create_all, which is what the test suite uses

Tests validate against 3 while prod runs 1.

Why #808 cares

We can't be programmatically certain about table completeness if our migrations do not reproduce productions schema. We owe #832 a trustworthy schema.

Scope

• Schema-only dumps of prod and of a freshly-migrated empty database, diffed.
• alembic check for the models-versus-database axis.
• Reconcile: a migration bringing the chain up to prod's actual state, or documented deliberate divergences.

Acceptance criteria

• The guarded-set enumeration is explicitly delegated to Step 0: enumerate the guarded set by FK reachability and measure delegation cost #832, which cannot start until the table list is trustworthy.
• A schema diff between prod and migrations-from-empty is captured in this issue.
• alembic upgrade head from empty produces prod's schema, or every remaining difference has a written reason.
• CI asserts the migrated schema matches Base.metadata.