chore: sync the deployed branch onto upstream tag v1.6.0

[escooterclinic]

Resyncs the deployed branch onto upstream tag v1.6.0, completing the pair started by #11
(which did the same for main). 56 commits, 197 files.

esc-live serves jobs.escooterclinic.co.uk, remotecrew.co.uk/jobs and — through the same
image — ats.fiszu.com, the admin ATS holding candidate PII. It was 164 commits and two
releases behind the real upstream, and nothing had measured that because the fork's upstream
remote named a dead mirror (hahzterry/reqcore) until 5a924c5.

Why the tag and not upstream HEAD

Upstream main has been red since 2026-08-11 (npm ci, EUSAGE / missing oxc-parser@0.144.0).
v1.6.0 is the last green point, and esc-live shares a real merge-base with it (f154021,
2026-07-03) — so this is an ordinary merge, not a graft.

Gate — green, run locally

== no-workflows ==            pass
== install ==                 npm ci, found 0 vulnerabilities
== lint ==                    pass
== typecheck ==               pass
== tests ==                   44 files, 574 tests, all passed
== dependency audit ==        found 0 vulnerabilities
== build ==                   pass
verify: all push gates passed.

Upstream v1.6.0 carries plain carets on the AI-SDK family and is exposed the moment its
lockfile is regenerated: the tail of every current AI-SDK major is under advisory, and
@ai-sdk/provider-utils 4.0.41+ pulls undici ^5.29.0 — all of undici 5.x sits inside
GHSA-vrm6-8vpv-qv8q (HIGH). No fixed release exists inside those majors; the fix is
ai 7 / @ai-sdk 4 / provider-utils 5, a breaking change through the scoring and shortlisting
path. This branch therefore carries dated < ceilings as a freeze, not a fix, documented in
the //ai-sdk-ceilings key in package.json and filed as its own task. They must not outlive
that upgrade — they also block genuine fixes.

Database

Nine new migrations, 0036–0044. All purely additive — CREATE TABLE, ADD COLUMN,
CREATE TYPE, CREATE INDEX; no DROP, no ALTER COLUMN, no RENAME. They apply at boot via
server/plugins/migrations.ts under a Postgres advisory lock, so the three containers starting
together cannot race. Because nothing is removed, a container still running the old image keeps
working against the migrated schema.

Also in this branch

• overlay/esc/README.md: the "upstream went closed-source" note was wrong and had been
  steering every reader for six weeks. reqcore-inc/reqcore is actively developed; the 2-commit
  stub that was read as upstream was a different repository. The false note is kept in a
  <details> block so nobody re-derives it, under a correction that names the test:
  git merge-base --is-ancestor distinguishes a dead mirror from a dead project — a stale
  pushed_at only suggests it.
• The redeploy command omitted app. All three surfaces build from the same source, but the
  documented build list named only app-public and app-esc. That is why reqcore-app is
  running a 2026-07-13 image while the two public boards were rebuilt on 2026-08-12 — the
  admin ATS, the one surface holding candidate PII, was a month stale by documentation.
• sync-upstream.sh + .sync-upstream.conf carried onto this branch, so the next sync is a
  command rather than a re-derivation.