Implement lambda backed custom resources for database migrations

Approximate steps to implement this

1. Add a dedicated migration runner that executes the Drizzle migrations.
2. Package the runner as its own Lambda artifact, separate from the main app Lambda, and include the migration files.
3. Add a migration Lambda to the notifications stack.
4. Ensure the migration Lambda runs in the same VPC and private subnets as the database.
5. Give the migration Lambda a security group that can reach Postgres.
6. Grant it access to the required SSM parameters or secrets.
7. Consider whether it needs a longer timeout than the main app Lambda.
8. Add a Lambda-backed custom resource using the standard AWS CDK custom resource primitives. There is no `guCDK` equivalent.
9. Make the custom resource invoke the migration Lambda during stack update.
10. Fail the stack if the migration fails.
11. Only run the migration handler for `Create` and `Update` events, not for `Delete`.
12. Add a rerun trigger. CloudFormation only reruns a custom resource when its properties change, so we would need to pass something versioned, such as a migration artifact hash or a build ID.

Keep migrations forward-safe:

- Ensure idempotency if retries happen.
- Treat recovery as fix-forward rather than rolling back the schema.
- Use advisory locking when running migrations.

Start by locating the notifications stack, the existing Lambda packaging, and the Drizzle migration entry point. Review the AWS CDK custom-resource primitives and define the migration Lambda's VPC, security-group, secret access, timeout, and rerun-trigger requirements; done means stack Create and Update events run forward-safe migrations and fail when migration execution fails.

Written by the indexing model from the issue text.