Feat v0.5.5 upgrade testing

Upgrade test harness, schema edge case tests, and two bug fixes found
during testing.

New: docker-compose-upgrade.yml + ci/e2e-upgrade-test.sh for single-replica
upgrade testing (seed → upgrade → verify). ci/e2e-upgrade-rolling.sh for
multi-replica rolling upgrade with shared Postgres. 11 Go unit tests for
schema migration edge cases, settings preservation, and package compat.

Fix: Bundled permission auto-grant on Postgres — SQL used SQLite-style
`granted = 1` on BOOLEAN columns. Now dialect-aware (true/false on PG).
Fix: E2E chat test API fields — login, token extraction, profile endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose-upgrade.yml

@@ -0,0 +1,86 @@
+# docker-compose-upgrade.yml — Upgrade Testing (Postgres)
+#
+# Two-phase environment: run the "old" image to seed data, then
+# swap in the "new" image and verify data integrity post-upgrade.
+#
+# Usage:
+#   ci/e2e-upgrade-test.sh   (orchestrates build → seed → upgrade → verify)
+#
+# Manual usage:
+#   docker build -t switchboard-core:v-old .
+#   docker compose -f docker-compose-upgrade.yml up postgres switchboard-old -d
+#   # ... seed data ...
+#   docker compose -f docker-compose-upgrade.yml stop switchboard-old
+#   docker compose -f docker-compose-upgrade.yml up switchboard-new -d
+#   # ... verify data ...
+#   docker compose -f docker-compose-upgrade.yml down -v
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: switchboard_upgrade
+      POSTGRES_USER: switchboard
+      POSTGRES_PASSWORD: upgrade-password
+    ports:
+      - "5433:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U switchboard -d switchboard_upgrade"]
+      interval: 2s
+      timeout: 5s
+      retries: 10
+
+  switchboard-old:
+    image: switchboard-core:v-old
+    environment:
+      PORT: "8080"
+      BASE_PATH: ""
+      DB_DRIVER: postgres
+      DATABASE_URL: postgres://switchboard:upgrade-password@postgres:5432/switchboard_upgrade?sslmode=disable
+      JWT_SECRET: upgrade-jwt-secret
+      ENCRYPTION_KEY: upgrade-encryption-key-32chars!!
+      SWITCHBOARD_ADMIN_USERNAME: admin
+      SWITCHBOARD_ADMIN_PASSWORD: admin
+      STORAGE_BACKEND: pvc
+      STORAGE_PATH: /data/storage
+      CORS_ALLOWED_ORIGINS: "*"
+      EXT_ALLOW_PRIVATE_IPS: "true"
+      LOG_FORMAT: text
+      LOG_LEVEL: info
+      SEED_USERS: "alice:password123:user,bob:password456:user"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    ports:
+      - "3001:80"
+    volumes:
+      - upgrade_storage:/data/storage
+
+  switchboard-new:
+    image: core-switchboard-new
+    environment:
+      PORT: "8080"
+      BASE_PATH: ""
+      DB_DRIVER: postgres
+      DATABASE_URL: postgres://switchboard:upgrade-password@postgres:5432/switchboard_upgrade?sslmode=disable
+      JWT_SECRET: upgrade-jwt-secret
+      ENCRYPTION_KEY: upgrade-encryption-key-32chars!!
+      SWITCHBOARD_ADMIN_USERNAME: admin
+      SWITCHBOARD_ADMIN_PASSWORD: admin
+      STORAGE_BACKEND: pvc
+      STORAGE_PATH: /data/storage
+      CORS_ALLOWED_ORIGINS: "*"
+      EXT_ALLOW_PRIVATE_IPS: "true"
+      LOG_FORMAT: text
+      LOG_LEVEL: info
+      SEED_USERS: "alice:password123:user,bob:password456:user"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    ports:
+      - "3001:80"
+    volumes:
+      - upgrade_storage:/data/storage
+
+volumes:
+  upgrade_storage: