The tradein deploy re-ran every data/sql/*.sql on every deploy and
swallowed failures via `|| echo "(skipped...)"`, so a genuinely failed
migration was reported as success and the deploy continued on a broken
schema — root cause of the verification-debt incident (H1).
Port the proven _schema_migrations tracking pattern from deploy.yml:
apply each migration exactly once; on failure `exit 1` instead of
swallowing. Add a first-run baseline — when the tracking table does not
pre-exist, seed all current filenames as already-applied WITHOUT running
them, so the live 001-076 schema (7 migrations carry non-idempotent
INSERT seeds) is not re-executed under the new strict ON_ERROR_STOP gate.
Migration block keeps its load-bearing position (after `up -d`, before
the tradein-backend restart that retries the FDW USER MAPPING hook,
PR #493). No --single-transaction (3 migrations use CREATE INDEX
CONCURRENTLY).
Closes#636
