Elevate DDL paths with SET ROLE in alembic env.py and manual migrations

[bencap]

Scope

One shared helper, two classes of caller:

• alembic/env.py issues SET ROLE mavedb_owner after connect. This is the right place rather than a wrapper script, because alembic is invoked by hand from the api container and there is no wrapper to put it in.
• The 8 scripts in alembic/manual_migrations/ do the same.

Without this, DDL fails with permission denied. Under RLS this means an UPDATE returns 0 rows with no error, so a data migration would silently do nothing.

Acceptance criteria

• env.py and all 8 manual migration scripts elevate through one shared helper.
• The helper is the only place SET ROLE appears.
• A migration run without elevation fails loudly.
• manual_migrations/README documents the requirement for future scripts.