Automate DB migrations + fix audit trigger + drop forced password change

- scripts/run-migrations.mjs: auto-applies unapplied .sql files on
  npm run dev/setup via psql, tracks state in _migrations table
- 020_fixes.sql: sets password_change_required=FALSE for all users,
  fixes audit_password_change UUID cast, re-enables trigger
- package.json: hook migrations into dev:precheck
- setup.mjs: hook into npm run setup
- run_all.sql: add 020_fixes.sql to migration order

scripts/setup.mjs

@@ -202,7 +202,16 @@ if (!existsSync(resolve(ROOT, ".env.local"))) {
   console.log("\n── .env.local already exists, skipping ──")
 }
 
-// 5. Self-healing build check (--self-heal flag)
+// 5. Database migrations (auto-applies on fresh install)
+console.log("\n── Running Database Migrations ──")
+try {
+  execSync("node scripts/run-migrations.mjs", { stdio: "inherit", timeout: 30000, cwd: ROOT })
+  console.log("  ✓ Migrations complete")
+} catch {
+  console.log("  ~ Database not available — run migrations later with: npm run dev")
+}
+
+// 6. Self-healing build check (--self-heal flag)
 if (doSelfHeal) {
   console.log("\n── Self-Healing Build Check ──")
   const { generateModule } = loadRegistry()
@@ -252,7 +261,7 @@ if (doSelfHeal) {
   }
 }
 
-// 6. Final summary
+// 7. Final summary
 console.log("\n── Final Steps ──")
 console.log("  1. Make sure PostgreSQL is running with database 'crm'")
 console.log("  2. Pull the Ollama model:  ollama pull dolphin-llama3:8b")