feat(listener): enforce database integrity constraints on core tables

[najeebullahii]

Closes #844.

Changes:

• CHECK constraints restricting every closed status/state domain to its exact code-defined enums: scheduled notifications (PENDING/PROCESSING/COMPLETED/FAILED/CANCELLED), execution attempts (SUCCESS/FAILED/RETRY), processed events (PROCESSED/SKIPPED/ERROR), idempotency keys (PROCESSED/EXPIRED), backpressure (ACTIVATED/DEACTIVATED), rate-limit client types (IP/API_KEY), and notification archive terminal states.
• Required relationships enforced: existing parent-child FKs retained with deliberate actions (CASCADE for execution-log/dead-letter/idempotency children the archive worker deletes; RESTRICT for template audit history); PRAGMA foreign_keys=ON verified at Database.connect() AND independently in the migration runner, with tests proving enforcement.
• Invalid states rejected at the storage layer; existing semantic unique keys (processed fingerprint, cursor contract, idempotency key, dead-letter notification id) preserved and pre-audited.
• Migration 004 uses the SQLite table-rebuild pattern in a single idempotent transaction: preflight audits count would-be violations and ABORT with an actionable table+count error (fail closed) before any DDL; rows copy unchanged; indexes/triggers recreated. Mirrored identically in schema.sql and archive-schema.sql for fresh-install parity.
• Fixes a latent migration-runner defect: callback-based sqlite3 run/all were awaited as if promise-returning, which let connections close before rollback completed and undermined transaction guarantees. Narrow promisify wrapper added.
• Deliberately NOT added: UNIQUE(notification_id, attempt) — the dead-letter retry path resets retry_count, so (notification, attempt) pairs legitimately repeat. Documented in the migration comments.

Testing: legacy-shape migration test seeds pre-constraint rows across every rebuilt table (including archive), runs 004 via MigrationRunner, and asserts byte-identical survival, zero PRAGMA foreign_key_check violations, rejection of orphan/out-of-enum/duplicate-key writes, fail-closed abort on invalid legacy status, repeatability, and rollback-audit behaviour. Focused DB/dead-letter/dedup suites unaffected. New files Prettier-clean.

Notes: migration numbered 004 and independent of delivery_receipts to avoid collision with in-flight PR #889 (which adds 003). Pre-existing baseline untouched: full npm test red on main (~55 failing suites: request-id.ts syntax error, Stellar XDR test setup, config secret validation); npm run lint fails on index.ts/request-id.ts/security-headers.ts/discord-notification.ts; lockfile out of sync with package.json (this PR modifies neither).

[drips-wave]

@najeebullahii Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[najeebullahii]

CI baseline (verified at upstream/main HEAD): migrations and verify-frozen-lockfiles both fail on main itself — the former due to the duplicate-003 numbering collision (four files claiming migration 003, including merged #889), the latter due to the pre-existing lockfile/package.json desync. This PR's focused suites are green (004: 3/3; stacked 004+005: 6/6) and it modifies no package manifests.

[najeebullahii]

Union scope note (push 8368708): main has since merged a DEAD_LETTERED terminal status, RPC-fallback/circuit-breaker config, and a retry rework. The merge union restores main's config loaders and de-duplicates the retry path; migration CHECK enums now include DEAD_LETTERED wherever the repository writes it (bootstrap/rebuild parity, with explicit test coverage). Archive CHECK correctly remains limited to COMPLETED, FAILED, CANCELLED since the archive service only archives those terminal states. Focused suites green (004: 4/4, config: 58/58, dead-letter+retry: 79/79).