Remove ad-hoc `_ensure_*` DDL now that Alembic owns the schema

[peteski22]

Part of #257 — Phase 1 step (7).
RFC: #275.

Goal

Once the Alembic baseline + stamp-on-startup is deployed in every
environment, remove the legacy _ensure_schema(),
ensure_review_columns(), and ensure_users_table() calls. Schema
ownership moves entirely to Alembic.

Gate

Do not merge until the "Baseline Alembic migration + stamp-on-startup
logic" child has been released and confirmed running in all known
deployments. Rollback path is to redeploy the previous version.

Scope

• Remove _ensure_schema() and ensure_* calls from SqliteStore
  and app.py.
• Remove the PRAGMA table_info() introspection helpers.
• Tests that asserted column-add behavior at startup are removed or
  rewritten as Alembic migration tests.

Acceptance criteria

• Server starts cleanly on a fresh database (Alembic creates schema).
• Server starts cleanly on a stamped database (no DDL re-runs).
• No PRAGMA table_info or ALTER TABLE ADD COLUMN in runtime
  startup paths.

Definition of Done

• TDD: tests added in the baseline-migration child for the three
  startup cases continue to pass after the legacy DDL is removed. Any
  test that was asserting the legacy _ensure_* behavior at startup
  is replaced with an Alembic-migration test.
• Full test suite green.
• Lint clean.
• Deployment docs note that schema is now owned exclusively by
  Alembic; rollback path documented (redeploy previous version).

Blocked by

• Baseline Alembic migration + stamp-on-startup logic (Phase 1
  child) — must be deployed in every environment first.