fix(database): B-1 schema integrity and migration fixes

- Fix migration 024 self-insert and bad column reference (F-B1-1, F-B1-2)
  Uses existing enabled/auto_run columns instead of non-existent deprecated
- Abort server on migration failure instead of warning (F-B1-11)
  main.go now calls log.Fatalf, prints [INFO] only on success
- Fix migration 018 scanner_config filename suffix (F-B1-3)
  Renumbered to 027 with .up.sql suffix
- Remove GRANT to non-existent role in scanner_config (F-B1-4)
- Resolve duplicate migration numbers 009 and 012 (F-B1-13)
  Renamed to 009b and 012b for unique lexical sorting
- Add IF NOT EXISTS to all non-idempotent migrations (F-B1-15)
  Fixed: 011, 012, 017, 023, 023a
- Replace N+1 dashboard stats loop with GetAllUpdateStats (F-B1-6)
  Single aggregate query replaces per-agent loop
- Add composite index on agent_commands(status, sent_at) (F-B1-5)
  New migration 028 with partial index for timeout service
- Add background refresh token cleanup goroutine (F-B1-10)
  24-hour ticker calls CleanupExpiredTokens
- ETHOS log format in migration runner (no emojis)

All 55 tests pass (41 server + 14 agent). No regressions.
See docs/B1_Fix_Implementation.md and DEV-025 through DEV-028.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/Deviations_Report.md

@@ -252,3 +252,35 @@ This document records deviations from the implementation spec.
 2. `example_integration.go` calls `machineid.ID()` directly instead of `GetMachineID()`
 
 **Action:** Not fixed in this pass (requires careful analysis of downstream effects). Flagged as D-1 fix prompt input. See `docs/Refactor_A_Series.md` Task 6 for full analysis.
+
+---
+
+## DEV-025: Background token cleanup without context cancellation (B-1)
+
+**Issue:** The background token cleanup goroutine in main.go uses a simple `time.NewTicker` loop without `context.Context` cancellation. main.go doesn't have a server-level context, so clean shutdown is handled by the deferred shutdown block and process signals.
+
+**Impact:** On server shutdown, the goroutine is killed by the OS. No data loss risk — `CleanupExpiredTokens` is a DELETE query that's atomic. The ticker approach is consistent with the existing offline-agent-check goroutine (same pattern, same file).
+
+---
+
+## DEV-026: Migration 024 fix uses Option B — existing columns (B-1)
+
+**Issue:** Migration 024 referenced a `deprecated` column that doesn't exist. Two options: (A) add the column in a new migration, (B) use existing `enabled`/`auto_run` columns.
+
+**Decision:** Option B. The migration's intent is to disable the legacy updates subsystem. `SET enabled = false, auto_run = false` achieves this using columns already in the schema (migration 015). Adding an unused `deprecated` column would be unnecessary complexity.
+
+---
+
+## DEV-027: Duplicate migration numbers resolved with suffix letters (B-1)
+
+**Issue:** Migrations 009 and 012 each had two files with the same numeric prefix.
+
+**Decision:** Renamed second files to `009b` and `012b`. The runner sorts lexically (`sort.Strings`), so `009b_add_retry_tracking.up.sql` sorts after `009_add_agent_version_tracking.up.sql` correctly. This preserves the original execution order and doesn't require a full renumber.
+
+---
+
+## DEV-028: Migration 018 renumbered to 027 (B-1)
+
+**Issue:** `018_create_scanner_config_table.sql` had wrong file suffix (.sql not .up.sql) AND shared number 018 with `018_create_metrics_and_docker_tables.up.sql`.
+
+**Decision:** Renumbered to 027. The scanner_config table has never been created by the runner (it was skipped due to wrong suffix), so existing databases don't have it. Number 027 is after all existing migrations, ensuring it runs last in the sequence.