[DB migration] Leveraging tools for DB migration

## Why this issue exists

`python -m diracx.db init-sql` calls `metadata.create_all`, which **creates missing tables and never
alters an existing one**. Any change to a table that already exists on a deployed installation has to be
applied by hand, from instructions in a PR description. Nothing records whether it was applied.

Until Alembic lands, every PR that modifies a `schema.py` for an already-released table is a latent
production incident. This issue tracks the work to fix that, and the PRs held behind it.

Supersedes #580 (Alembic triggers), which demonstrated the tool works but stalled on the scope questions
the ADR should now answer.

## PRs held behind this

- **#967 — token policies persisted in DB.** Adds `Policies` to `RefreshTokens`; requires
`ALTER TABLE RefreshTokens ADD COLUMN Policies JSON` on every existing installation, and hard-fails
token issuance if it was not run. Already expand-shaped (nullable column; the code falls back to
recomputing from `all_access_policies` on `NULL`), so it becomes the **first real revision** once the
setup PR lands. Agreed: not merged before then.