feat(schema): M4.1 — full tenant_registry schema + migrate binary

PLATFORM_ARCHITECTURE.md §5c schema, end-to-end:

  enums:    tenant_status (demo/trial/active/frozen/archived),
            tenant_kind (customer/demo), idp_kind (oidc/saml),
            tenant_project_status (active/archived)

  tables:   tenants            id/slug/name/status/kind/plan/erp_id/
                               stripe_id/trial_ends_at/contract_dates/
                               sales_owner
            tenant_projects    sub-tenancy (GCP-Project style); opt-in
                               via product manifest.supports_projects=true
            tenant_products    tenant ↔ product matrix + JSONB config
            tenant_idp_config  enterprise SSO (OIDC/SAML metadata)
            api_keys           argon2 hash + prefix + scopes + revoked_at
            audit_log          Retraced-compatible; indexed for cross-
                               product filtering per §8.4

  triggers: updated_at auto-bump on every mutable table
  fks:      ON DELETE CASCADE for owned rows; SET NULL for audit_log

cmd/migrate (new binary): golang-migrate as a library with migrations
embedded via migrations/embed.go; subcommands up/down/version/force.
Ships as a self-contained Orca init container in prod.

Tests (require Docker; gated by -short):
  TestMigrate_upDownRoundTrip   schema → 6 tables + 4 enums; down→
                                empty; up-after-down clean
  TestSeed_canInsertAndQuery    insert across every table; FK cascade;
                                audit_log SET-NULL keeps the row
  TestSlugConstraint            regex rejects too-short / leading dash /
                                trailing dash / uppercase / underscore

Makefile: migrate-up/down/down-all/version/create NAME=...; test-short
to skip integration when Docker isn't around; build-migrate for just
the migrator.

CI: pin golangci-lint to v2.12.2 (Go 1.25-compatible) + bump
golangci-lint-action to v7 (v6 rejects v2.x).

The handler-layer in-memory store is unchanged; M4.2 swaps it for the
pgx-backed implementation against this schema.

Refs: M4.1

Makefile

@@ -1,18 +1,33 @@
 # tenant-registry — Go service for tenant glue, audit, API keys.
 
-.PHONY: help dev test build fmt vet lint docker clean
+.PHONY: help dev test test-short build build-migrate fmt vet lint docker clean \
+        migrate-up migrate-down migrate-down-all migrate-version migrate-create
 
-ADDR ?= :8090
-APP_ENV ?= dev
+ADDR        ?= :8090
+APP_ENV     ?= dev
+DATABASE_URL ?= postgres://platform:platform-dev-pass@localhost:5432/platform?sslmode=disable
 
 help:
 	@echo "tenant-registry targets:"
-	@echo "  make dev         go run ./cmd/server (foreground, APP_ENV=dev)"
-	@echo "  make test        go test -race ./..."
-	@echo "  make build       compile binary to ./bin/tenant-registry"
-	@echo "  make fmt         go fmt ./..."
-	@echo "  make vet         go vet ./..."
-	@echo "  make docker      build local image (tenant-registry:dev)"
+	@echo ""
+	@echo "  Server:"
+	@echo "    make dev               go run ./cmd/server (foreground, APP_ENV=dev)"
+	@echo "    make build             compile to ./bin/tenant-registry"
+	@echo "    make build-migrate     compile to ./bin/migrate"
+	@echo "    make docker            build local image (tenant-registry:dev)"
+	@echo ""
+	@echo "  Schema:"
+	@echo "    make migrate-up        apply all pending migrations (uses DATABASE_URL)"
+	@echo "    make migrate-down      roll back the most recent migration"
+	@echo "    make migrate-down-all  roll back EVERY migration (DESTRUCTIVE)"
+	@echo "    make migrate-version   print current schema version"
+	@echo "    make migrate-create NAME=add_foo"
+	@echo "                           create a new pair of empty migration files"
+	@echo ""
+	@echo "  CI:"
+	@echo "    make test              go test -race ./...   (includes testcontainers)"
+	@echo "    make test-short        go test -race -short ./...   (skips integration)"
+	@echo "    make fmt | vet | lint"
 
 dev:
 	@APP_ENV=$(APP_ENV) ADDR=$(ADDR) go run ./cmd/server
@@ -20,11 +35,19 @@ dev:
 test:
 	@go test -race ./...
 
+test-short:
+	@go test -race -short ./...
+
 build:
 	@mkdir -p bin
 	@CGO_ENABLED=0 go build -o bin/tenant-registry ./cmd/server
 	@echo "built ./bin/tenant-registry"
 
+build-migrate:
+	@mkdir -p bin
+	@CGO_ENABLED=0 go build -o bin/migrate ./cmd/migrate
+	@echo "built ./bin/migrate"
+
 fmt:
 	@gofmt -w .
 	@test -z "$$(gofmt -l .)"
@@ -39,3 +62,26 @@ docker:
 
 clean:
 	@rm -rf bin
+
+# ─── migrations ────────────────────────────────────────────────────────────
+
+migrate-up:
+	@DATABASE_URL=$(DATABASE_URL) go run ./cmd/migrate up
+
+migrate-down:
+	@DATABASE_URL=$(DATABASE_URL) go run ./cmd/migrate down
+
+migrate-down-all:
+	@DATABASE_URL=$(DATABASE_URL) go run ./cmd/migrate -all down
+
+migrate-version:
+	@DATABASE_URL=$(DATABASE_URL) go run ./cmd/migrate version
+
+migrate-create:
+ifndef NAME
+	$(error usage: make migrate-create NAME=add_something)
+endif
+	@n=$$(ls migrations/*.up.sql 2>/dev/null | wc -l); \
+	next=$$(printf "%04d" $$((n + 1))); \
+	touch migrations/$${next}_$(NAME).up.sql migrations/$${next}_$(NAME).down.sql; \
+	echo "created migrations/$${next}_$(NAME).{up,down}.sql"