feat(console): add db:migrate CLI for idempotent core schema updates

Existing systems used to have no automatic mechanism for the
db/updates/*.sql idempotent updates after `git pull` — devs had to
remember which files were already applied and run new ones manually
with `mariadb < ...`. Mirror module:migrate to fix this:

- New `bin/console db:migrate` walks db/updates/*.sql in alphabetical
  order, skipping anything already recorded in the new core_migrations
  tracking table. Each file runs in its own transaction; failure
  rolls back so the file is retried on the next run.
- New `db:migrate --status` lists applied vs. pending files without
  running anything. Useful for ops debugging "schema seems stale"
  symptoms.
- module:sync now runs db:migrate as its first step, so the standard
  post-pull command stays a single invocation. README's 3-step setup
  is unchanged — module:sync now also covers core schema updates.

CoreMigrationRepository owns its own mysqli connection (using the
same DB credentials as MintyPHP\DB) and runs raw `$mysqli->query()`
instead of going through DB::query's prepared statement path —
MariaDB rejects some DDL (e.g. ALTER TABLE … ADD CONSTRAINT CHECK)
in the prepared protocol, which the existing 18 db/updates files
trip on. ModuleMigrationRepository is left untouched (no module
migration uses such DDL today and changing the vendor pattern is
out of scope).

End-to-end verified: against an existing DB the first run applies
all 19 idempotent files as no-ops and records them, second run
reports "all updates already applied". Against a freshly init'd
DB the same thing happens — no double work, no surprises. All
encrypted seed secrets keep decrypting because APP_CRYPTO_KEY
is unchanged.

Tests: tests/Console/CoreCommandsTest covers success/failure/status
output shapes against a FakeModuleRunner (mirror of the existing
ModuleCommandsTest pattern). 5 stale baseline entries in
phpstan-baseline removed (covered by the new @api annotation on
the test fixture class).

Docs: CLAUDE.md and docs/reference-cli-commands.md document the
new command + --status flag; docs/howto-fehlerbehebung.md gains
a "schema seems stale after git pull" section pointing at
db:migrate --status.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/App/Container/Registrars/AppServicesRegistrar.php

@@ -17,6 +17,8 @@ use MintyPHP\Http\RequestRuntimeInterface;
 use MintyPHP\Http\SessionStore;
 use MintyPHP\Http\SessionStoreInterface;
 use MintyPHP\Repository\Access\PermissionRepository;
+use MintyPHP\Repository\Database\CoreMigrationRepository;
+use MintyPHP\Repository\Database\CoreMigrationRepositoryInterface;
 use MintyPHP\Repository\Module\ModuleMigrationRepository;
 use MintyPHP\Repository\Search\SearchQueryRepository;
 use MintyPHP\Repository\Stats\AdminStatsRepository;
@@ -27,6 +29,7 @@ use MintyPHP\Service\CustomField\CustomFieldServicesFactory;
 use MintyPHP\Service\CustomField\TenantCustomFieldService;
 use MintyPHP\Service\CustomField\UserCustomFieldValueService;
 use MintyPHP\Service\Data\GridUserCountEnricher;
+use MintyPHP\Service\Database\CoreMigrationService;
 use MintyPHP\Service\Import\ImportService;
 use MintyPHP\Service\Import\ImportServicesFactory;
 use MintyPHP\Service\Mail\MailLogService;
@@ -84,6 +87,12 @@ final class AppServicesRegistrar implements ContainerRegistrar
             $c->get(ModuleRegistry::class),
             $c->get(ModuleMigrationRepository::class)
         ));
+        $container->set(CoreMigrationRepository::class, static fn (): CoreMigrationRepository => new CoreMigrationRepository());
+        $container->set(CoreMigrationRepositoryInterface::class, static fn (AppContainer $c): CoreMigrationRepositoryInterface => $c->get(CoreMigrationRepository::class));
+        $container->set(CoreMigrationService::class, fn (AppContainer $c): CoreMigrationService => new CoreMigrationService(
+            $c->get(CoreMigrationRepositoryInterface::class),
+            $projectRoot . '/db/updates'
+        ));
         $container->set(ModulePermissionSynchronizer::class, fn (AppContainer $c): ModulePermissionSynchronizer => new ModulePermissionSynchronizer(
             $c->get(ModuleRegistry::class),
             $c->get(PermissionRepository::class),