feat(backend): migrations Postgres testées (users, devices, resources, operations, ocr_jobs) + migrate au boot

- golang-migrate embarqué via embed (db/migrations/*.sql), MigrateDatabase(url) au boot
- ids TEXT 32-hex avec CHECK ~ '^[0-9a-f]{32}$' ; operations idempotentes UNIQUE(device_id, operation_id)
- harness db/migrations_test.go (up → assertions schéma → down, skip si PG indisponible)
- DB dev fraîche vaultdrop_dev (la DB vaultdrop héberge un prototype V2 abandonné)

backend/db/migrations/000005_create_ocr_jobs.up.sql

@@ -0,0 +1,15 @@
+CREATE TABLE ocr_jobs (
+    job_id TEXT PRIMARY KEY CHECK (job_id ~ '^[0-9a-f]{32}$'),
+    file_id TEXT NOT NULL REFERENCES resources(resource_id) ON DELETE CASCADE,
+    device_id TEXT NOT NULL REFERENCES devices(device_id) ON DELETE CASCADE,
+    status TEXT NOT NULL DEFAULT 'queued' CHECK (status IN ('queued', 'processing', 'done', 'failed')),
+    language VARCHAR(64) DEFAULT 'fra+eng',
+    text TEXT,
+    error TEXT,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    started_at TIMESTAMPTZ,
+    completed_at TIMESTAMPTZ
+);
+
+CREATE INDEX idx_ocr_jobs_status ON ocr_jobs(status);
+CREATE INDEX idx_ocr_jobs_file ON ocr_jobs(file_id);