deploy: prod-only pipeline with Drizzle migrations; dev refresh + preview

- push to main builds, backs up prod (pg_dump 17), runs db-migrate + seeds,
  preflights and deploys; rollback = workflow_dispatch with rollback_tag
- staging workflow, promote step and migrate-*.ts / old SQL removed
- DB_URL = app role, DB_MIGRATE_URL = owner role
- scripts/db-refresh-dev.sh (prod dump -> local dev DB), scripts/preview.sh <branch>

docs/house-tracker.md

@@ -51,7 +51,7 @@ HOUSE_NTFY_TOKEN=            # only for a protected ntfy topic
 PUBLIC_MAPTILER_API_KEY=     # already set for Animaldex
 ```
 
-`scripts/migrate-house-tracker.ts` runs on every deploy (idempotent). Use
+The `house` schema is part of the Drizzle migrations that run on every deploy. Use
 "send test alert" on the page to check the alert channel.
 
 If Cloudflare Bot Fight Mode / WAF challenges are on for stanrunge.dev, add a