Remove the unauthenticated webhook and the SQLite migration script

Both existed to carry an upgrade across, and both upgrades are done.

/api/alertmanager/webhook took no credential at all: anything able to
reach the port could open an incident for anybody. v0.12.0 kept it,
deprecated, so the teams release did not stop delivery while the
Alertmanager config was edited, and logged a line per payload asking to
be moved. The cluster's Alertmanager now posts on an integration key --
verified in the log, every two minutes, with no deprecation line since
the rollout -- so the door can be shut rather than left ajar until
somebody remembers. A sender still posting there gets the JSON 404 every
unknown /api path gets.

The tests move with it, which they should have done anyway: the harness
mints an integration key for the default team and posts on that, so they
exercise the path production uses rather than one only they still used.

scripts/sqlite-to-postgres.go goes the same way. It was written to be
temporary, it was the last thing needing modernc.org/sqlite, and this
install migrated on 2026-09-20. `go mod tidy` drops the driver and its
six transitive dependencies with it; the module graph is now chi, pgx,
pgerrcode and x/crypto. Anyone still on v0.10.x can take the script out
of the v0.12.0 tag, which the README now says.

Claude-Session: https://claude.ai/code/session_01RHPj4ggeFdEjKKfm4SHbD7

README.md

@@ -182,19 +182,39 @@ In the Helm chart the two sweeper durations are set via `sweeper.staleAfter` and
 
 ## Alertmanager configuration
 
-Add terdut-server as a webhook receiver in your `alertmanager.yml`:
+Alerts arrive on a team's **integration key**, which says both that the sender
+may post and which team the alerts belong to. Mint one as an owner of the team:
+
+```bash
+curl -X POST https://terdut.example.com/api/teams/1/integrations \
+  -H "Authorization: Bearer $TERDUT_API_KEY" \
+  -H 'Content-Type: application/json' \
+  -d '{"name":"prod alertmanager"}'
+```
+
+The response carries the key and the full URL **once**; only a SHA-256 hash is
+stored. Put it in your `alertmanager.yml`:
 
 ```yaml
 receivers:
   - name: terdut
     webhook_configs:
-      - url: http://terdut-server:8080/api/alertmanager/webhook
+      - url: http://terdut-server:8080/api/integrations/<key>/alertmanager
         send_resolved: true
 
 route:
   receiver: terdut
 ```
 
+The whole URL is a credential, so treat it like one. Alertmanager 0.26 and
+later can read it from a file with `url_file:` instead, which keeps it out of
+your configuration repository:
+
+```yaml
+      - url_file: /etc/alertmanager/secrets/terdut-webhook-url/url
+        send_resolved: true
+```
+
 The webhook endpoint requires no authentication.
 
 If you use the [dead man's switch](#dead-mans-switch) — and the default configuration does — give
@@ -447,7 +467,7 @@ of the last heartbeat, and the heartbeat's labels are on the incident's
 
 ### Authentication
 
-All endpoints except `/api/bootstrap`, `/api/alertmanager/webhook`,
+All endpoints except `/api/bootstrap`, `/api/integrations/{key}/alertmanager`,
 `/api/notify/ack/{token}`, `/api/login` and `/api/logout` require either an API key:
 
 ```
@@ -517,10 +537,10 @@ and the full URL once and stores only a SHA-256 hash.
 | Method | Path | Description |
 |---|---|---|
 | `POST` | `/api/integrations/{key}/alertmanager` | Alertmanager v4 webhook receiver for the key's team. `401` for an unknown key |
-| `POST` | `/api/alertmanager/webhook` | **Deprecated, unauthenticated.** The pre-teams receiver, kept for one release so an upgrade does not stop delivering while the Alertmanager config is edited. Routes everything to the oldest team |
 
-The deprecated path is why anything that can reach the port can still open an
-incident. Move senders to a key and it goes away.
+This is the only way in. The pre-teams `POST /api/alertmanager/webhook` took no
+credential at all — anything able to reach the port could open an incident —
+and was removed in v0.13.0 once senders had moved onto keys.
 
 ### Teams
 
@@ -765,10 +785,11 @@ name on them.
 
 What changes, and will need attention:
 
-- **Alert ingestion moved.** `POST /api/alertmanager/webhook` still works but is
-  deprecated and unauthenticated, and routes everything to the oldest team. Mint
-  a key with `POST /api/teams/{teamID}/integrations` and point Alertmanager at
-  the URL it returns. The old path goes away in a later release.
+- **Alert ingestion moved.** Mint a key with
+  `POST /api/teams/{teamID}/integrations` and point Alertmanager at the URL it
+  returns. In v0.12.0 the old `POST /api/alertmanager/webhook` still worked,
+  deprecated, routing everything to the oldest team; **v0.13.0 removes it**, so
+  upgrade straight from v0.11.x to v0.13.0 only after the senders are moved.
 - **The schedule endpoints moved** under `/api/teams/{teamID}/schedule`, and
   editing the rota is now an owner's job. `GET /api/schedule/current` stayed
   where it was but now returns an **array** — one entry per team with somebody
@@ -810,30 +831,25 @@ non-administrator now gets `403` where a `200` used to come back.
 
 ## Upgrading from SQLite
 
-Versions up to v0.10.2 stored everything in a SQLite file. From the Postgres release onwards
-the server needs `TERDUT_DB_DSN` and keeps nothing on disk.
+Versions up to v0.10.2 stored everything in a SQLite file. From v0.11.1 the server needs
+`TERDUT_DB_DSN` and keeps nothing on disk.
 
-The cutover is ordered — the server must not be running while the copy happens:
+The copy was done by `scripts/sqlite-to-postgres.go`, which **was deleted in v0.13.0** along
+with the SQLite driver it was the last user of. It is still in the history — check out the
+`v0.12.0` tag to get it:
 
 ```bash
-# 1. Stop the old server, keeping its database file.
-# 2. Create an empty Postgres database, then let the new binary build the schema:
-TERDUT_DB_DSN='postgres://terdut:secret@localhost:5432/terdut?sslmode=disable' ./terdut &
-#    ...watch for "listening on", then stop it again.
-# 3. Copy the data across:
-go run -tags migrate ./scripts/sqlite-to-postgres.go \
-    -sqlite /data/terdut.db \
-    -dsn 'postgres://terdut:secret@localhost:5432/terdut?sslmode=disable'
-# 4. Start the new server for good.
+git show v0.12.0:scripts/sqlite-to-postgres.go > sqlite-to-postgres.go
 ```
 
+The cutover is ordered, and the server must not be running while the copy happens: stop the
+old version, let the new binary build the schema against an empty Postgres, run the script
+with `-sqlite` and `-dsn`, then start the new version for good. On Kubernetes step three runs
+as a Job with the same image against the PVC before it is removed.
+
 The copy preserves every id, so incidents keep their numbers and the timeline, alert
 membership, outbox and ack tokens all still point where they did. It refuses a target that
-already has rows, so a second run cannot double-insert. On Kubernetes, step 3 runs as a Job
-with the same image against the PVC before it is removed.
-
-The script is deliberately temporary: it is the only thing left that needs the SQLite driver,
-and both should be deleted once the installs that need them have migrated.
+already has rows, so a second run cannot double-insert.
 
 ## Upgrading to incidents