Remove the unauthenticated webhook and the SQLite migration script

Both existed to carry an upgrade across, and both upgrades are done.

/api/alertmanager/webhook took no credential at all: anything able to
reach the port could open an incident for anybody. v0.12.0 kept it,
deprecated, so the teams release did not stop delivery while the
Alertmanager config was edited, and logged a line per payload asking to
be moved. The cluster's Alertmanager now posts on an integration key --
verified in the log, every two minutes, with no deprecation line since
the rollout -- so the door can be shut rather than left ajar until
somebody remembers. A sender still posting there gets the JSON 404 every
unknown /api path gets.

The tests move with it, which they should have done anyway: the harness
mints an integration key for the default team and posts on that, so they
exercise the path production uses rather than one only they still used.

scripts/sqlite-to-postgres.go goes the same way. It was written to be
temporary, it was the last thing needing modernc.org/sqlite, and this
install migrated on 2026-09-20. `go mod tidy` drops the driver and its
six transitive dependencies with it; the module graph is now chi, pgx,
pgerrcode and x/crypto. Anyone still on v0.10.x can take the script out
of the v0.12.0 tag, which the README now says.

Claude-Session: https://claude.ai/code/session_01RHPj4ggeFdEjKKfm4SHbD7

internal/api/router.go

@@ -31,14 +31,13 @@ func NewRouter(db *sql.DB, notify NotifyConfig) http.Handler {
 
 	// Alert ingestion. The key in the path says both that the sender may post
 	// and which team the alerts belong to, which is why it needs no session.
+	//
+	// This is the only way in. The pre-teams /api/alertmanager/webhook, which
+	// took no credential at all, was removed in v0.13.0 once the cluster's
+	// Alertmanager had moved onto a key; a sender still posting there gets the
+	// JSON 404 every unknown /api path gets.
 	r.Post("/api/integrations/{key}/alertmanager", handleIntegrationWebhook(db, notify))
 
-	// DEPRECATED, and unauthenticated: anything that can reach the port can
-	// open an incident here. Kept for one release so an upgrade does not stop
-	// delivering while the Alertmanager config is edited; it routes everything
-	// to the oldest team. Remove it once senders carry a key.
-	r.Post("/api/alertmanager/webhook", handleLegacyWebhook(db, notify))
-
 	// Signing in to the web UI. Login trades a password for a session cookie,
 	// which AuthMiddleware accepts in place of an API key.
 	r.Post("/api/login", handleLogin(db, newLoginLimiter(), notify.PublicURL))