migrate: install the instance's masking before brant can log a DSN

brant reports a migration directory it cannot open with slog.Error("failed to
create provider", "datasource", a.DataSourceName, ...) -- the connection
string, password and all, at ERR level. A missing directory is what an installed
package is in until its first migration ships, so this is an ordinary path
rather than an exotic one.

This binary installed no slog handler at all, so that record went to Go's
built-in stderr handler and no mask list of any kind applied -- while cmd/specsrht
had been masking a DSN correctly for as long as this one had been printing one.
It now installs the same handler from the same policy. The verbosity comes from
DefaultsWithoutDebugFlag, because -d here is brant's --dialect and takes a value.

Half a fix without the ecore bump: "datasource" was not a spelling the mask list
knew until 9a4d2ed. Both halves are pinned by a subprocess test, and removing
either turns it red.

The log package goes with it. slog.SetDefault reroutes the std logger through the
installed handler at info level, so a log.Fatalf left behind would be silently
dropped by an operator's log-level=warn -- an error message swallowed by a
logging preference.

Not fixable from here: brant's cli.initLogger runs ahead of that record and under
--json replaces the installed handler with a plain JSON one of its own. Nothing
passes --json; the default branch leaves the handler alone.

authn: remove the local agent-token plane

The agent_token table and everything that minted, verified, listed or revoked
it. Agent credentials are tokens.sr.ht working tokens now: signed, expiring,
owned by a meta.sr.ht account and carrying grants, verified locally by
sr-ht-ecore's bearer package. One door, and nothing behind it — a credential the
instance plane refuses is refused, where it used to be offered to a second store
that might say yes.

DEPLOY GATE: do not deploy this until every agent configured with the shared
secret holds a tokens.sr.ht token with spec:propose (spec:read to read).
Migration 0005 drops the table, migrate-on-upgrade runs it on deploy, and
deploying early locks out every agent at once — including the SSH push path.

hooks/ no longer reads agent_token directly. The push path goes through the same
authn.Resolver the HTTP surfaces use and demands spec:propose, because a push by
an agent is a proposal by another transport. The refs rule and the provenance
requirement are untouched on both counts: a universal grant is still only an
agent to the receive path, and X-Agent / X-Agent-Session are still mandatory on
every agent write.

bearer.ErrNotOurs is now a permanent refusal. A meta.sr.ht PAT used to fall
through to the local store and miss there; with no store to fall through to it
earns a 401 rather than the 503 an unclassified error would.

[tokens.sr.ht] origin becomes a required config key: with no issuer there is no
credential to check, so the daemon fails startup instead of serving reads and
refusing every agent write one request at a time.

/tokens redirects to the daemon that issues (tokens SPEC ch. 7).

feat: specsrht-migrate — brant wrapper for the spec.sr.ht schema

Single-service wrapper around git.sr.ht/~bitfehler/brant, a close sibling of
doltsrht-migrate: the brant subcommands (up, down, current, list, stamp,
validate, ping) plus an extra `init` that applies schema.sql wholesale and
stamps to head for a fresh install.

The DSN comes from [spec.sr.ht]connection-string unless --dsn overrides it;
a missing or empty value is a fatal error rather than a default connection.
Migrations load from ./migrations in a checkout, else from
<[sr.ht]assets>/migrations/spec.sr.ht. -a honours [spec.sr.ht]migrate-on-upgrade
and exits early when it is off. lib/pq's "postgres" driver replaces brant's
pgx default, which this module does not link.

Tests cover flag parsing, DSN precedence and the migrations-directory
resolution order without a database; the init/up round trips against a scratch
schema skip unless SPECSRHT_TEST_PG is set.