feat(backend): migrations Postgres testées (users, devices, resources, operations, ocr_jobs) + migrate au boot

- golang-migrate embarqué via embed (db/migrations/*.sql), MigrateDatabase(url) au boot
- ids TEXT 32-hex avec CHECK ~ '^[0-9a-f]{32}$' ; operations idempotentes UNIQUE(device_id, operation_id)
- harness db/migrations_test.go (up → assertions schéma → down, skip si PG indisponible)
- DB dev fraîche vaultdrop_dev (la DB vaultdrop héberge un prototype V2 abandonné)

backend/db/migrations/000001_create_users.up.sql

@@ -0,0 +1,13 @@
+CREATE TABLE users (
+    id TEXT PRIMARY KEY CHECK (id ~ '^[0-9a-f]{32}$'),
+    email VARCHAR(255),
+    display_name VARCHAR(255),
+    parent_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+    storage_quota_bytes BIGINT DEFAULT 10737418240,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW(),
+    deleted_at TIMESTAMPTZ
+);
+
+CREATE UNIQUE INDEX idx_users_email ON users(email) WHERE email IS NOT NULL AND deleted_at IS NULL;
+CREATE INDEX idx_users_parent ON users(parent_user_id) WHERE deleted_at IS NULL;