feat: prepare external API persistence foundation

[bballdavis]

Summary

• adds the durable persistence foundation for external API policy, channel grants, requests, and quota accounting
• preserves existing API keys as legacy_download while keeping current creation, hashing, validation, usage tracking, deletion, and single-video behavior unchanged
• creates new tables directly in their final shape and registers their Sequelize associations normally

Part of #568.

Scope boundaries

This phase exposes no external routes, authentication middleware, request execution, management endpoints, rate-limit enforcement, feature flags, Swagger contract, or frontend UI.

Migration safety

• rebased onto the current dev baseline
• four focused migrations extend API keys and create channel grants, external requests, and usage buckets
• obsolete pre-normalization compatibility markers have been removed
• existing duplicate channel rows are left untouched; this PR adds no channel identity constraint or consolidation
• catalog-table and query-specific request indexes are deferred to the runtime PR, where they can be reviewed with the consuming queries and EXPLAIN evidence
• existing keys receive safe legacy defaults, and rollback deactivates external-role keys before removing their policy fields
• partial migration and rollback states tolerate missing policy columns and indexes

Validation

• backend and frontend lint plus TypeScript checks passed
• 197 backend suites and 5,656 tests passed with zero skipped; backend line coverage is 90.71%
• 277 frontend suites and 5,155 tests passed with zero skipped; frontend line coverage is 89.06%
• the dedicated migration lifecycle passed on MariaDB 10.3 and MySQL 8.0 (one executed test per engine, zero skipped), covering legacy-key preservation, duplicate channels, partial recovery, final schema and collation validation, rollback, and reapply
• documentation checks and build passed; the required All Checks workflow passed on PR head 5358ac1b
• package.json adds only the dedicated database test script; package-lock.json remains aligned with current dev

[dialmaster]

The main blockers for this PR (see my other comments):

• the global brace-expansion override breaks minimatch
• the channel dedupe migration can leave an install unable to start
• the eight 20260726 no-op migrations need to go
• squashing the migrations together (eg, no need for multiple migrations for the same new table)

[dialmaster]

See my comment on line 23 of migrations/20260908100000-add-external-api-key-policy.js, just one last minor thing and then I think this will be good to approve :)