fix(database): B-1 schema integrity and migration fixes

- Fix migration 024 self-insert and bad column reference (F-B1-1, F-B1-2)
  Uses existing enabled/auto_run columns instead of non-existent deprecated
- Abort server on migration failure instead of warning (F-B1-11)
  main.go now calls log.Fatalf, prints [INFO] only on success
- Fix migration 018 scanner_config filename suffix (F-B1-3)
  Renumbered to 027 with .up.sql suffix
- Remove GRANT to non-existent role in scanner_config (F-B1-4)
- Resolve duplicate migration numbers 009 and 012 (F-B1-13)
  Renamed to 009b and 012b for unique lexical sorting
- Add IF NOT EXISTS to all non-idempotent migrations (F-B1-15)
  Fixed: 011, 012, 017, 023, 023a
- Replace N+1 dashboard stats loop with GetAllUpdateStats (F-B1-6)
  Single aggregate query replaces per-agent loop
- Add composite index on agent_commands(status, sent_at) (F-B1-5)
  New migration 028 with partial index for timeout service
- Add background refresh token cleanup goroutine (F-B1-10)
  24-hour ticker calls CleanupExpiredTokens
- ETHOS log format in migration runner (no emojis)

All 55 tests pass (41 server + 14 agent). No regressions.
See docs/B1_Fix_Implementation.md and DEV-025 through DEV-028.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aggregator-server/cmd/server/main.go

@@ -186,14 +186,12 @@ func main() {
 		return
 	}
 
-	// Run migrations
+	// Run migrations — abort on failure (F-B1-11 fix)
 	migrationsPath := filepath.Join("internal", "database", "migrations")
 	if err := db.Migrate(migrationsPath); err != nil {
-		// For development, continue even if migrations fail
-		// In production, you might want to handle this more gracefully
-		fmt.Printf("Warning: Migration failed (tables may already exist): %v\n", err)
+		log.Fatalf("[ERROR] [server] [database] migration_failed error=%q — server cannot start with incomplete schema", err)
 	}
-	fmt.Println("[OK] Database migrations completed")
+	log.Printf("[INFO] [server] [database] migrations_complete")
 
 	agentQueries := queries.NewAgentQueries(db.DB)
 	updateQueries := queries.NewUpdateQueries(db.DB)
@@ -442,6 +440,24 @@ func main() {
 		}
 	}()
 
+	// Background refresh token cleanup (F-B1-10 fix)
+	go func() {
+		ticker := time.NewTicker(24 * time.Hour)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-ticker.C:
+				count, err := refreshTokenQueries.CleanupExpiredTokens()
+				if err != nil {
+					log.Printf("[ERROR] [server] [database] refresh_token_cleanup_failed error=%q", err)
+				} else if count > 0 {
+					log.Printf("[INFO] [server] [database] refresh_token_cleanup_complete removed=%d", count)
+				}
+			}
+		}
+	}()
+
 	// Start timeout service
 	timeoutService.Start()
 	log.Println("Timeout service started")