Adds users (citext email, nullable password_hash so a user can be
invited before claiming) and password_tokens (hashed one-shot tokens
for initial-set and reset, with purpose + TTL + used_at).
Token raw values live only in the email body; the DB stores SHA256
of the token so a DB leak doesn't grant account access.
DB.connect! opens a single Sequel connection from DATABASE_URL; DB.migrate!
runs Sequel migrations from db/migrations/.
The first migration creates the invoices table: uuid PK, unique invoice
number, client + currency fields, JSONB for line items, GEL conversion rate
captured at issue time, paid_at for the status toggle, pdf_key for the
MinIO object.
