feat(database)!: replace postgres with sqlite - #61

The bot stores its data for a single guild, and each instance was given
its own postgres database to hold it. That cost a database server per
instance: a second container to pull and run, credentials to configure,
a healthcheck to wait on, and around 45 MiB of resident memory that the
bot did not need. The data itself is a handful of rows per guild, so a
file is enough.

The database is now SQLite, through modernc.org/sqlite. The driver is
pure Go, which keeps the build at CGO_ENABLED=0 and the runtime image
unchanged. It binds $1-style placeholders by index the way postgres
does, so the query text carried over without being rewritten, and it
binds them correctly: mattn/go-sqlite3 and ncruces/go-sqlite3 both
bind by order of appearance, which would have put the wrong values in
the wrong place in the queries that build their argument list.

Timestamps are stored as Unix milliseconds in INTEGER columns. SQLite
has no timestamp type, and the obvious alternative is silently wrong:
the driver writes a time.Time as text while a column default writes an
integer, so the column holds two kinds of value and SQLite orders it by
kind rather than by instant. Storing integers and letting the driver
convert keeps the column and the comparisons exact. The subtleties of
that representation are written down in AGENTS.md, since the two ways of
getting it wrong are a query that returns rows out of order and one that
fails to scan.

The schema uses INTEGER PRIMARY KEY AUTOINCREMENT. The AUTOINCREMENT
matters: without it SQLite reuses an id after a delete, and the
pagination cursor compares (created_at, id), so a reused id would make
a page skip rows. The moderation log index ends with id for the same
reason, and without it SQLite sorts every page again with a temporary
B-tree over the table. A test asserts the query plan, so the sort
cannot come back unnoticed.

The migration runner hands a file to the driver as one statement
instead of splitting it on semicolons. The driver knows the quoting
rules, so a semicolon inside a string literal no longer cuts a
statement in half. Two indexes that the unique constraints and the
composite index already covered are gone.

DB_PATH names the file, and DB_BOT_INSTANCE_ID names it when DB_PATH
is unset, so instances sharing a directory still get one file each.
The instance id is filtered down to characters that are safe in a file
name. The image creates the data directory owned by the user it runs
as, so a named volume mounted over it is writable without anyone
having to fix its permissions by hand.

Breaking: DATABASE_URL, DB_HOST, DB_PORT, DB_USER, DB_PASSWORD,
DB_NAME and POSTGRES_PASSWORD are gone, replaced by DB_PATH and
DB_BOT_INSTANCE_ID. compose.yaml no longer starts a database service.

There is no migration path for an existing postgres database. Nothing
was deployed against it, so there is nothing to carry over.

docs/OPERATIONS/DATABASE.md covers where the file lives, how to back
it up, and how to read it. The backup uses VACUUM INTO, because the
write-ahead log beside the file holds writes that a plain copy would
miss.