db: Drizzle schemas on domain Postgres schemas, baseline migration, reorg SQL

- pgSchema tables for auth, money, house, ref, games, cs, animaldex, site, meta
  (lists excluded via schemaFilter; runtime list tables are managed by meta.*)
- drizzle/ baseline matches the reorged DB exactly (catalog diff = 0 on rehearsal)
- db/reorg: one-time SQL that moves the flat public schema (rehearsed on a prod copy)
- scripts/db-migrate.ts: migrator with --init to record the baseline and a guard
  against running the baseline on a non-empty, unrecorded database

db/reorg/run.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# run.sh <target-db> : stage the dev import, then apply 01..08 in ONE transaction as superuser.
+# Rehearsal: runs against the private PG17 cluster in ~/dev/setup/db/rehearsal (port 5441, unix socket only).
+# Prod: same files, but psql = `sudo docker exec -i <pg-container> psql -U postgres -d personal` (see PLAN.md §4c).
+set -euo pipefail
+DB=${1:?target db}
+case "$DB" in personal|personal_dev|personal_staging) [ "${ALLOW_REAL:-}" = yes ] || { echo "refusing $DB without ALLOW_REAL=yes"; exit 3; };; esac
+D=~/dev/setup/db
+export LD_LIBRARY_PATH=$D/tools/root/usr/lib/x86_64-linux-gnu
+BIN=$D/tools/root/usr/lib/postgresql/17/bin
+CONN=(-h "${PGSOCK:-$D/rehearsal/sock}" -p "${PGPORT:-5441}" -U postgres)
+STAGED=${STAGED:-$D/dumps/dev-import-staged.dump}
+
+# 1) stage dev data as import_* schemas (owned by personal so 06 can read it)
+$BIN/psql "${CONN[@]}" -d "$DB" -v ON_ERROR_STOP=1 -qc "DROP SCHEMA IF EXISTS import_energy, import_hardware, import_cs CASCADE"
+$BIN/pg_restore "${CONN[@]}" -d "$DB" --no-owner --role=personal --single-transaction --exit-on-error "$STAGED"
+
+# 2) the migration, all-or-nothing
+cd "$D/migration"
+$BIN/psql "${CONN[@]}" -d "$DB" -v ON_ERROR_STOP=1 --single-transaction \
+  -c "SET lock_timeout = '5s'" -c "SET statement_timeout = '10min'" \
+  -f 01_roles.sql -f 02_schemas_move.sql -f 03_fixes.sql -f 04_meta.sql -f 05_lists.sql \
+  -f 06_hardware_energy_cs.sql -f 07_triggers_meta_grants.sql -f 09_drizzle_names.sql -f 08_verify.sql
+echo "migration committed on $DB"