Forward-only SQLite migration runner lifted from authd (src/db/migrate.ts,
PR #14 / merge ced21ab) and parameterized for cross-project use. The single
deliberate API change vs. authd's source: the previously-hardcoded
GENESIS_PROBE_TABLE = 'users' is now an ApplyOptions.genesisProbeTable?: string
option (default 'users').
