step 4: fresh kernel-only migrations

Deleted all 23+23 old chat-switchboard migration files.
Wrote 9+9 clean kernel-only migrations in postgres/ and sqlite/ subdirs.

27 tables per dialect covering all 20 store interfaces:
  001: users, refresh_tokens, policies, settings, presence, oidc
  002: teams, team_members, groups, group_members
  003: packages, package_user_settings, ext_permissions, ext_data_tables
  004: ext_connections, ext_dependencies, resource_grants
  005: notifications, notification_preferences
  006: audit_log
  007: workflows, workflow_stages, workflow_versions
  008: tasks, task_runs
  009: ws_tickets, rate_limit_counters

Dropped: providers, personas, channels, messages, knowledge, notes,
memory, workspaces, projects, folders, files, usage_log, tool_health,
workflow_assignments, ext_view_channels.

Schema changes vs old:
  - pgvector extension removed (no KB embeddings)
  - resource_grants: resource_type CHECK removed (open-ended)
  - workflow_stages: persona_id kept as nullable TEXT (no FK)
  - workflow_stages: stage_mode default=form_only, added custom
  - tasks: dropped output_channel_id, provider_config_id columns
  - tasks: task_type removed prompt, output_mode: notification|webhook|log
  - task_runs: dropped channel_id
  - platform_policies: kernel-only seeds
  - global_settings: kernel-only seeds, site name=Switchboard Core
  - Everyone group: kernel permissions (extension.use, workflow.submit)

-2815/+487 lines.

server/database/migrations/sqlite/002_teams.sql

@@ -1,11 +1,12 @@
--- Chat Switchboard — 002 Teams & Access Control (SQLite)
--- Consolidated v0.28.0
+-- ==========================================
+-- Switchboard Core — 002 Teams & Access Control (SQLite)
+-- ==========================================
 
 CREATE TABLE IF NOT EXISTS teams (
     id          TEXT PRIMARY KEY,
     name        TEXT NOT NULL UNIQUE,
     description TEXT DEFAULT '',
-    created_by  TEXT NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
+    created_by  TEXT NOT NULL REFERENCES users(id),
     is_active   INTEGER DEFAULT 1,
     settings    TEXT DEFAULT '{}',
     created_at  TEXT DEFAULT (datetime('now')),
@@ -14,6 +15,10 @@ CREATE TABLE IF NOT EXISTS teams (
 
 CREATE INDEX IF NOT EXISTS idx_teams_active ON teams(is_active);
 
+CREATE TRIGGER IF NOT EXISTS teams_updated_at AFTER UPDATE ON teams
+    FOR EACH ROW WHEN NEW.updated_at = OLD.updated_at
+    BEGIN UPDATE teams SET updated_at = datetime('now') WHERE id = NEW.id; END;
+
 CREATE TABLE IF NOT EXISTS team_members (
     id          TEXT PRIMARY KEY,
     team_id     TEXT NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
@@ -43,7 +48,11 @@ CREATE TABLE IF NOT EXISTS groups (
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_groups_name_scope
-    ON groups(name, COALESCE(team_id, ''));
+    ON groups(name, COALESCE(team_id, '00000000-0000-0000-0000-000000000000'));
+
+CREATE TRIGGER IF NOT EXISTS groups_updated_at AFTER UPDATE ON groups
+    FOR EACH ROW WHEN NEW.updated_at = OLD.updated_at
+    BEGIN UPDATE groups SET updated_at = datetime('now') WHERE id = NEW.id; END;
 
 CREATE TABLE IF NOT EXISTS group_members (
     id          TEXT PRIMARY KEY,
@@ -57,13 +66,11 @@ CREATE TABLE IF NOT EXISTS group_members (
 CREATE INDEX IF NOT EXISTS idx_group_members_group ON group_members(group_id);
 CREATE INDEX IF NOT EXISTS idx_group_members_user ON group_members(user_id);
 
-INSERT OR IGNORE INTO groups
-    (id, name, description, scope, created_by, source, permissions, created_at, updated_at)
+INSERT OR IGNORE INTO groups (id, name, description, scope, created_by, source, permissions)
 VALUES (
     '00000000-0000-0000-0000-000000000001',
     'Everyone',
     'Implicit group — all authenticated users receive these permissions.',
     'global', NULL, 'system',
-    '["model.use","kb.read","channel.create"]',
-    datetime('now'), datetime('now')
+    '["extension.use","workflow.submit"]'
 );