feat: Worker portal Stage 3 — DB migrations for composition override layers

Description

Land the DB migrations for the three composition override layers per the Stage 2 storage-layering ADR. Forward-only migrations per ADR-016. The schema shape (per-layer tables vs unified config_documents) is set by the ADR — this issue implements whatever the ADR ratifies.

Three layers backed by DB (top-wins):

1. User personal layout (JSONB delta per (user_id, surface))
2. Role overrides (per (jurisdiction_id, role_slug, surface))
3. Jurisdiction live overrides (per (jurisdiction_id, surface))

The two non-DB layers (jurisdiction baseline TOML, system defaults) need no migrations.

Acceptance Criteria

• Migrations live under services/canopy-web/migrations/ (or wherever the ADR designates)
• Forward-only per ADR-016 (no down.sql)
• Schema matches whatever the Stage 2 ADR-NNN-composition-override-storage-layering ratified
• Indexes for the access patterns the composition loader needs (lookup by (jurisdiction, surface), (jurisdiction, role, surface), (user, surface))
• JSONB columns where the ADR specifies
• sqlx compile-time-verified queries scaffolded (even as stubs) so the loader issue can wire them
• Migration test: cargo nextest run -p canopy-web clean
• CHANGELOG entry under === Added

Blocked by

• Stage 2 storage-layering ADR merged

Context & References

• Tracking issue: #460
• Epic: &51
• Plan: worker-portal-redesign.adoc, Stage 3
• Related: ADR-016 (forward-only migrations), Stage 2 storage-layering ADR (blocking)

Labels

type::feature, priority::medium, program::infrastructure, service::web, workflow::needs-spec