Apply accounts-DB migrations on deploy (#219)

The deploy scripts pulled code and restarted but never applied the
hand-written SQL migrations in deploy/migrations/, so column additions to
the long-lived accounts DB had to be run by hand.

Add deploy/migrate-db.py, an idempotent runner that resolves the accounts
DB the same way the app does (THERMOGRAPH_ACCOUNTS_DB or
<repo>/data/accounts.sqlite), applies any files not yet recorded in a
schema_migrations table, and:
  - backs the DB up before touching it;
  - baselines a fresh DB (no file, or no user table) rather than ALTERing
    a table create_all() will build with the current schema on next start;
  - tolerates an already-present column/index (hand-applied or model-built)
    by recording it instead of failing.

Wire it into deploy.sh (prod) and deploy-dev.sh (dev) just before the
service restarts, so new code never queries a column an older DB lacks.
No env or systemd changes: the migration runs as the deploy user, who owns
the data dir.

Claude-Session: https://claude.ai/code/session_01XXxmNFy9cZ6Gh8Y9thZn62

deploy/deploy.sh

@@ -43,6 +43,15 @@ fi
 .venv/bin/pip install --upgrade pip -q
 .venv/bin/pip install -r backend/requirements.txt -q
 
+# Apply any pending accounts-DB schema migrations before the new code starts, so
+# it never queries a column an older database lacks. Idempotent and tracked, so
+# every deploy can run it; sourcing the env picks up a THERMOGRAPH_ACCOUNTS_DB
+# override if one is set. Runs as the deploy user, who owns the data dir.
+echo "==> Applying database migrations"
+( set -a; . /etc/thermograph.env 2>/dev/null || true; set +a
+  "$APP_DIR/.venv/bin/python" "$APP_DIR/deploy/migrate-db.py"
+)
+
 echo "==> Restarting service"
 sudo systemctl restart thermograph