chore(db): align migration filenames with the applied prod versions

MCP apply_migration restamps the version it records; prod logged
20260815204334, not the 20260815120000 in the filename. Rename so
supabase db push does not rerun it, and renumber the follow-up drop
migration to stay after it.

Author: ralyodio

…ve_backup_pins_to_service_role_table.sql …ve_backup_pins_to_service_role_table.sqlsupabase/migrations/20260815120000_move_backup_pins_to_service_role_table.sql renamed to supabase/migrations/20260815204334_move_backup_pins_to_service_role_table.sql supabase/migrations/20260815120000_move_backup_pins_to_service_role_table.sql renamed to supabase/migrations/20260815204334_move_backup_pins_to_service_role_table.sql

@@ -67,7 +67,7 @@ ON CONFLICT (user_id) DO NOTHING;
 
 -- --------------------------------------------------------------------------
 -- The `users.backup_pin_hash` column itself is dropped by the NEXT migration,
--- 20260815120100_drop_users_backup_pin_hash.sql. It is deliberately a separate
+-- 20260815204400_drop_users_backup_pin_hash.sql. It is deliberately a separate
 -- step: this migration is additive and safe to apply to a running deployment,
 -- whereas the drop must not land until the application code that stopped
 -- reading that column has shipped.

…815120100_drop_users_backup_pin_hash.sql …815204400_drop_users_backup_pin_hash.sqlsupabase/migrations/20260815120100_drop_users_backup_pin_hash.sql renamed to supabase/migrations/20260815204400_drop_users_backup_pin_hash.sql supabase/migrations/20260815120100_drop_users_backup_pin_hash.sql renamed to supabase/migrations/20260815204400_drop_users_backup_pin_hash.sql

@@ -1,7 +1,11 @@
 -- Step 4b of the 2026-08 security remediation.
 -- Advisory: GHSA-jpfm-vrpc-p6rr
 --
--- Second half of 20260815120000_move_backup_pins_to_service_role_table.sql.
+-- Second half of 20260815204334_move_backup_pins_to_service_role_table.sql.
+--
+-- NOTE: when this is applied via the Supabase MCP, the ledger will restamp it
+-- with its own timestamp. Rename this file to match afterwards, or
+-- `supabase db push` will rerun it.
 -- That migration created the service-role-only `user_backup_pins` table and
 -- carried across which users have a PIN set. This one removes the column that
 -- every logged-in account could read via `users_select_authenticated`.