Let an operator authenticate with a seeded key, and reset the schema

- TERDUT_OPERATOR_KEY creates or re-keys the instance-scoped service account
  "terdut-operator" at every start, so terdut-operator needs no bootstrap
  handshake. An instance-scoped account now acts as owner of every team's
  configuration, but is not a member of any team.
- POST /api/teams takes an external_id (instance service accounts only) and
  is idempotent on it, so automation finds its own team again after a crash
  instead of adopting by display name. GET /api/teams?name= is removed.
- Integration and dead man's switch names are unique per team (409). The
  escalation PUT accepts usernames and resolves them itself.
- The 18 migrations are squashed into 001_schema.sql, with no Default team.
  TERDUT_DEADMAN_* and the env seeding of switches are removed: teams carry
  their own. Existing development databases must be recreated.

Security and robustness:
- GET /api/users no longer returns other people's email or ntfy topic to
  non-admins.
- The access log records the route pattern, so integration keys and ack
  tokens in the path are not written to the log. Server errors are logged.
- Rate limits take the client address TERDUT_TRUSTED_PROXIES hops from the
  right of X-Forwarded-For instead of trusting the first, forgeable entry.
- /api/bootstrap runs in a transaction under an advisory lock, so two
  concurrent calls cannot both create an administrator.
- API key last_used_at is written at most every five minutes.

Cleanup: remove GET /api/incidents/{id}/alerts, unused exports, SQLite
remnants in comments and config.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

cmd/terdut/main.go

@@ -39,21 +39,16 @@ func main() {
 		RepeatEvery:   cfg.NotifyRepeat,
 	}
 
-	// Dead man's switches live per team now. The environment variables are the
-	// defaults a team starts from: every team without a configuration of its
-	// own gets one from them here, and an owner's later edit is never
-	// overwritten by a redeploy.
-	deadman := api.ParseDeadmanConfig(cfg.DeadmanMatchers, cfg.DeadmanTimeout, cfg.DeadmanSeverity)
-	if err := api.SeedDeadmanConfigs(context.Background(), database, deadman); err != nil {
-		log.Fatalf("seed dead man's switch defaults: %v", err)
-	}
-
 	// The behaviour knobs move into the database on first start, after which an
 	// administrator owns them and a redeploy leaves them alone.
 	if err := api.SeedSettings(context.Background(), database, cfg); err != nil {
 		log.Fatalf("seed settings: %v", err)
 	}
 
+	if err := api.SeedOperatorKey(context.Background(), database, cfg.OperatorKey); err != nil {
+		log.Fatalf("%v", err)
+	}
+
 	router := api.NewRouter(database, notify, cfg, version)
 
 	srv := &http.Server{