db: introduce TypeORM migrations and stop relying on synchronize=true outside local dev

[phertyameen]

Summary

Schema management currently leans on TypeORMs synchronize flag, driven entirely by config (backend/src/config/database.config.ts, consumed in app.module.ts). There is no migrations/ directory and no migration workflow beyond the generic typeorm CLI script. Nothing prevents DB_SYNCHRONIZE=true from reaching production, where auto-sync can alter or drop columns with data loss. With 17 entities already across users, puzzles, streak, quests, analytics, game-sessions, and challenge-attempt, schema drift is the top operational risk.

Proposal

1. Add backend/src/database/migrations/; extract a reusable data-source factory out of the inline useFactory in app.module.ts so the CLI and the app share one config.
2. Wire npm scripts: migration:run, migration:revert, migration:generate.
3. Enforce safety: fail fast at boot when NODE_ENV=production && synchronize=true.
4. Document the flow in docs/DEVELOPMENT.md.

Acceptance criteria

• A fresh clone can produce the full schema purely via migration:run.
• Boot fails loudly if synchronize would run in production.
• An initial migration matching current entity definitions is checked in.