Extend semiplot_tags for pen settings and add group tables

Today

semiplot_tags is the one object SemiBase adds beside the archive (sql/semiplot_tags.sql:6-13):

CREATE TABLE IF NOT EXISTS semiplot_tags (
	id         integer PRIMARY KEY,   -- matches trends.id
	name       text    NOT NULL,
	group_name text,
	unit       text,
	color      text,
	line_style smallint NOT NULL DEFAULT 0
);

group_name holds one string per pen. There is no place for a pen's own scale, no stored visibility, and a pen cannot belong to two groups.

Wanted

One pen row holds everything the viewer needs to draw and label the pen. Groups become their own table so a pen can sit in several.

Columns added to semiplot_tags:

Existing columns keep their meaning. unit is free text (Pa, C, mbar, sccm, W, %). color is #RRGGBB. line_style is 0 interpolated, 1 stepped. group_name is replaced by the tables below.

CREATE TABLE semiplot_groups (
	id   integer GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
	name text NOT NULL UNIQUE
);

CREATE TABLE semiplot_pen_groups (
	pen_id   integer NOT NULL REFERENCES semiplot_tags (id) ON DELETE CASCADE,
	group_id integer NOT NULL REFERENCES semiplot_groups (id) ON DELETE CASCADE,
	PRIMARY KEY (pen_id, group_id)
);

Constraints: scale_min < scale_max when both are set, color matches ^#[0-9A-Fa-f]{6}$ or is NULL.

Migration runs inside provision and stays idempotent like the rest of it: ADD COLUMN IF NOT EXISTS, CREATE TABLE IF NOT EXISTS, one statement turning every distinct non-empty group_name into a semiplot_groups row with its links, then DROP COLUMN group_name. SemiPlot is the only reader and moves in the same release (Semiteq/SemiPlot#65), so no compatibility column stays behind.

Grants: SELECT to semiplot_reader on all three tables, full DML to semiplot_writer (#8).

Add the semiplot_meta table SemiPlot's docs already reserve for exactly this (SemiPlot docs/architecture/postgres-instance.md:79-81), holding one schema_version integer. The viewer then refuses an older database with a clear message instead of failing on a missing column.

Notes

• Y axes on the SemiPlot side become one per pen. unit is a label suffix, never an axis key. Group membership drives legend headers and bulk on/off only.
• A pen with no group row is legal and shows under an "Ungrouped" header.
• The SemiPlot bench seeder fills these tables; that half is Semiteq/SemiPlot#65. This issue covers DDL, migration, grants and docs.