Let an operator authenticate with a seeded key, and reset the schema

- TERDUT_OPERATOR_KEY creates or re-keys the instance-scoped service account
  "terdut-operator" at every start, so terdut-operator needs no bootstrap
  handshake. An instance-scoped account now acts as owner of every team's
  configuration, but is not a member of any team.
- POST /api/teams takes an external_id (instance service accounts only) and
  is idempotent on it, so automation finds its own team again after a crash
  instead of adopting by display name. GET /api/teams?name= is removed.
- Integration and dead man's switch names are unique per team (409). The
  escalation PUT accepts usernames and resolves them itself.
- The 18 migrations are squashed into 001_schema.sql, with no Default team.
  TERDUT_DEADMAN_* and the env seeding of switches are removed: teams carry
  their own. Existing development databases must be recreated.

Security and robustness:
- GET /api/users no longer returns other people's email or ntfy topic to
  non-admins.
- The access log records the route pattern, so integration keys and ack
  tokens in the path are not written to the log. Server errors are logged.
- Rate limits take the client address TERDUT_TRUSTED_PROXIES hops from the
  right of X-Forwarded-For instead of trusting the first, forgeable entry.
- /api/bootstrap runs in a transaction under an advisory lock, so two
  concurrent calls cannot both create an administrator.
- API key last_used_at is written at most every five minutes.

Cleanup: remove GET /api/incidents/{id}/alerts, unused exports, SQLite
remnants in comments and config.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/api/caller.go

@@ -2,7 +2,6 @@ package api
 
 import (
 	"context"
-	"fmt"
 
 	"git.ryuvia.com/niklas/terdut-server/internal/models"
 )
@@ -61,7 +60,7 @@ func (c Caller) IsAdmin() bool {
 // by being a human (and becomes its owner as a side effect), an
 // instance-scoped service account creates one with no human owner at all;
 // the two paths are not interchangeable, so this predicate must not also
-// admit a human admin the way MayActAsInstanceAdmin deliberately does.
+// admit a human admin the way an administrator check would.
 func (c Caller) IsInstanceServiceAccount() bool {
 	return c.sa != nil && c.sa.scope == models.ServiceAccountScopeInstance
 }
@@ -110,24 +109,6 @@ func (c Caller) ServiceAccountName() (string, bool) {
 	return c.sa.name, true
 }
 
-// Identity is a stable, log/audit-facing string distinguishing a human
-// caller from a service account — "user:42" or "service-account:7". Not
-// wired into any database column — incidents.go's acknowledged_by/
-// incident_events.user_id use AsHuman()/ServiceAccountID() directly against
-// the parallel *_service_account_id columns (migration 015) instead, since a
-// column needs the id, not this rendered string. assigned_to stays
-// human-only and out of scope (terdut-server#25's follow-up).
-func (c Caller) Identity() string {
-	switch {
-	case c.user != nil:
-		return fmt.Sprintf("user:%d", c.user.ID)
-	case c.sa != nil:
-		return fmt.Sprintf("service-account:%d", c.sa.id)
-	default:
-		return "unknown"
-	}
-}
-
 func callerFromContext(ctx context.Context) (Caller, bool) {
 	c, ok := ctx.Value(ctxCaller).(Caller)
 	return c, ok