feat(schema): M4.1 — tenant_registry schema + migrate binary

PLATFORM_ARCHITECTURE.md §5c schema as one initial migration: 6 tables + 4 enums + updated_at triggers. cmd/migrate binary (golang-migrate library, embedded SQL). testcontainers round-trip + seed + slug-constraint tests.

Refs: M4.1

Makefile

@@ -1,18 +1,33 @@
 # tenant-registry — Go service for tenant glue, audit, API keys.
 
-.PHONY: help dev test build fmt vet lint docker clean
+.PHONY: help dev test test-short build build-migrate fmt vet lint docker clean \
+        migrate-up migrate-down migrate-down-all migrate-version migrate-create
 
-ADDR ?= :8090
-APP_ENV ?= dev
+ADDR        ?= :8090
+APP_ENV     ?= dev
+DATABASE_URL ?= postgres://platform:platform-dev-pass@localhost:5432/platform?sslmode=disable
 
 help:
 	@echo "tenant-registry targets:"
-	@echo "  make dev         go run ./cmd/server (foreground, APP_ENV=dev)"
-	@echo "  make test        go test -race ./..."
-	@echo "  make build       compile binary to ./bin/tenant-registry"
-	@echo "  make fmt         go fmt ./..."
-	@echo "  make vet         go vet ./..."
-	@echo "  make docker      build local image (tenant-registry:dev)"
+	@echo ""
+	@echo "  Server:"
+	@echo "    make dev               go run ./cmd/server (foreground, APP_ENV=dev)"
+	@echo "    make build             compile to ./bin/tenant-registry"
+	@echo "    make build-migrate     compile to ./bin/migrate"
+	@echo "    make docker            build local image (tenant-registry:dev)"
+	@echo ""
+	@echo "  Schema:"
+	@echo "    make migrate-up        apply all pending migrations (uses DATABASE_URL)"
+	@echo "    make migrate-down      roll back the most recent migration"
+	@echo "    make migrate-down-all  roll back EVERY migration (DESTRUCTIVE)"
+	@echo "    make migrate-version   print current schema version"
+	@echo "    make migrate-create NAME=add_foo"
+	@echo "                           create a new pair of empty migration files"
+	@echo ""
+	@echo "  CI:"
+	@echo "    make test              go test -race ./...   (includes testcontainers)"
+	@echo "    make test-short        go test -race -short ./...   (skips integration)"
+	@echo "    make fmt | vet | lint"
 
 dev:
 	@APP_ENV=$(APP_ENV) ADDR=$(ADDR) go run ./cmd/server
@@ -20,11 +35,19 @@ dev:
 test:
 	@go test -race ./...
 
+test-short:
+	@go test -race -short ./...
+
 build:
 	@mkdir -p bin
 	@CGO_ENABLED=0 go build -o bin/tenant-registry ./cmd/server
 	@echo "built ./bin/tenant-registry"
 
+build-migrate:
+	@mkdir -p bin
+	@CGO_ENABLED=0 go build -o bin/migrate ./cmd/migrate
+	@echo "built ./bin/migrate"
+
 fmt:
 	@gofmt -w .
 	@test -z "$$(gofmt -l .)"
@@ -39,3 +62,26 @@ docker:
 
 clean:
 	@rm -rf bin
+
+# ─── migrations ────────────────────────────────────────────────────────────
+
+migrate-up:
+	@DATABASE_URL=$(DATABASE_URL) go run ./cmd/migrate up
+
+migrate-down:
+	@DATABASE_URL=$(DATABASE_URL) go run ./cmd/migrate down
+
+migrate-down-all:
+	@DATABASE_URL=$(DATABASE_URL) go run ./cmd/migrate -all down
+
+migrate-version:
+	@DATABASE_URL=$(DATABASE_URL) go run ./cmd/migrate version
+
+migrate-create:
+ifndef NAME
+	$(error usage: make migrate-create NAME=add_something)
+endif
+	@n=$$(ls migrations/*.up.sql 2>/dev/null | wc -l); \
+	next=$$(printf "%04d" $$((n + 1))); \
+	touch migrations/$${next}_$(NAME).up.sql migrations/$${next}_$(NAME).down.sql; \
+	echo "created migrations/$${next}_$(NAME).{up,down}.sql"