Let an operator authenticate with a seeded key, and reset the schema

- TERDUT_OPERATOR_KEY creates or re-keys the instance-scoped service account
  "terdut-operator" at every start, so terdut-operator needs no bootstrap
  handshake. An instance-scoped account now acts as owner of every team's
  configuration, but is not a member of any team.
- POST /api/teams takes an external_id (instance service accounts only) and
  is idempotent on it, so automation finds its own team again after a crash
  instead of adopting by display name. GET /api/teams?name= is removed.
- Integration and dead man's switch names are unique per team (409). The
  escalation PUT accepts usernames and resolves them itself.
- The 18 migrations are squashed into 001_schema.sql, with no Default team.
  TERDUT_DEADMAN_* and the env seeding of switches are removed: teams carry
  their own. Existing development databases must be recreated.

Security and robustness:
- GET /api/users no longer returns other people's email or ntfy topic to
  non-admins.
- The access log records the route pattern, so integration keys and ack
  tokens in the path are not written to the log. Server errors are logged.
- Rate limits take the client address TERDUT_TRUSTED_PROXIES hops from the
  right of X-Forwarded-For instead of trusting the first, forgeable entry.
- /api/bootstrap runs in a transaction under an advisory lock, so two
  concurrent calls cannot both create an administrator.
- API key last_used_at is written at most every five minutes.

Cleanup: remove GET /api/incidents/{id}/alerts, unused exports, SQLite
remnants in comments and config.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/api/deadman_test.go

@@ -1,7 +1,6 @@
 package api_test
 
 import (
-	"context"
 	"net/http"
 	"strings"
 	"testing"
@@ -122,8 +121,11 @@ func TestDeadman_MixedGroupExcludesHeartbeat(t *testing.T) {
 		t.Fatalf("expected 1 incident for the real alert, got %d", got)
 	}
 
-	var alerts []map[string]any
-	decode(t, s.req(t, http.MethodGet, "/api/incidents/1/alerts", nil), &alerts)
+	var incident struct {
+		Alerts []map[string]any `json:"alerts"`
+	}
+	decode(t, s.req(t, http.MethodGet, "/api/incidents/1", nil), &incident)
+	alerts := incident.Alerts
 	if len(alerts) != 1 {
 		t.Fatalf("expected 1 member alert, got %d", len(alerts))
 	}
@@ -717,26 +719,3 @@ func TestDeadman_DeleteIsScopedToTheTeam(t *testing.T) {
 		t.Errorf("expected no switches, got %d", got)
 	}
 }
-
-// The environment's defaults are handed out once and then belong to the teams.
-func TestDeadman_SeedRunsOnce(t *testing.T) {
-	s := newTS(t)
-	cfg := api.ParseDeadmanConfig("alertname=Watchdog", time.Hour, "critical")
-
-	if err := api.SeedDeadmanConfigs(context.Background(), s.db, cfg); err != nil {
-		t.Fatalf("seed: %v", err)
-	}
-	if got := len(listSwitches(t, s)); got != 1 {
-		t.Fatalf("the first seed should add the default, got %d switches", got)
-	}
-
-	// The owner deletes it; a restart must not put it back.
-	id := int64(listSwitches(t, s)[0]["id"].(float64))
-	s.req(t, http.MethodDelete, "/api/teams/"+defaultTeam+"/deadman/switches/"+id64(id), nil).Body.Close()
-	if err := api.SeedDeadmanConfigs(context.Background(), s.db, cfg); err != nil {
-		t.Fatalf("seed again: %v", err)
-	}
-	if got := len(listSwitches(t, s)); got != 0 {
-		t.Errorf("a second seed resurrected %d switch(es)", got)
-	}
-}