Remove the unauthenticated webhook and the SQLite migration script

Both existed to carry an upgrade across, and both upgrades are done.

/api/alertmanager/webhook took no credential at all: anything able to
reach the port could open an incident for anybody. v0.12.0 kept it,
deprecated, so the teams release did not stop delivery while the
Alertmanager config was edited, and logged a line per payload asking to
be moved. The cluster's Alertmanager now posts on an integration key --
verified in the log, every two minutes, with no deprecation line since
the rollout -- so the door can be shut rather than left ajar until
somebody remembers. A sender still posting there gets the JSON 404 every
unknown /api path gets.

The tests move with it, which they should have done anyway: the harness
mints an integration key for the default team and posts on that, so they
exercise the path production uses rather than one only they still used.

scripts/sqlite-to-postgres.go goes the same way. It was written to be
temporary, it was the last thing needing modernc.org/sqlite, and this
install migrated on 2026-09-20. `go mod tidy` drops the driver and its
six transitive dependencies with it; the module graph is now chi, pgx,
pgerrcode and x/crypto. Anyone still on v0.10.x can take the script out
of the v0.12.0 tag, which the README now says.

Claude-Session: https://claude.ai/code/session_01RHPj4ggeFdEjKKfm4SHbD7

internal/api/api_test.go

@@ -21,10 +21,14 @@ import (
 // tests can age rows directly — the sweeper's inputs are wall-clock timestamps.
 type ts struct {
 	*httptest.Server
-	key     string
-	db      *sql.DB
-	notify  api.NotifyConfig
-	deadman api.DeadmanConfig
+	key string
+	// ingestKey is an integration key for the default team: the only way in
+	// since the unauthenticated webhook was removed, so the tests exercise the
+	// same path production does.
+	ingestKey string
+	db        *sql.DB
+	notify    api.NotifyConfig
+	deadman   api.DeadmanConfig
 }
 
 // newTS builds a server over a fresh database. Notifications are off
@@ -66,6 +70,16 @@ func newDeadmanTS(t *testing.T, deadman api.DeadmanConfig, notify ...api.NotifyC
 
 	s := &ts{Server: srv, key: key, db: database, notify: cfg, deadman: deadman}
 
+	var integration struct {
+		Key string `json:"key"`
+	}
+	decode(t, s.req(t, http.MethodPost, "/api/teams/"+defaultTeam+"/integrations",
+		map[string]string{"name": "test"}), &integration)
+	if integration.Key == "" {
+		t.Fatal("no integration key was returned")
+	}
+	s.ingestKey = integration.Key
+
 	// Dead man's switches belong to a team now, so a test that wants them
 	// configures the default team the way an owner would.
 	if deadman.Timeout > 0 {
@@ -234,7 +248,8 @@ func postWebhook(t *testing.T, s *ts, alerts []map[string]any, groupKey ...strin
 		}
 	}
 	data, _ := json.Marshal(payload)
-	resp, err := http.Post(s.URL+"/api/alertmanager/webhook", "application/json", bytes.NewReader(data))
+	resp, err := http.Post(s.URL+"/api/integrations/"+s.ingestKey+"/alertmanager",
+		"application/json", bytes.NewReader(data))
 	if err != nil {
 		t.Fatalf("post webhook: %v", err)
 	}