Update .kiro: remove SQLite hooks, add PostgreSQL migration hook, add workflow steering, sync specs

.kiro/hooks/migration-registration-check.kiro.hook

@@ -0,0 +1,16 @@
+{
+  "enabled": true,
+  "name": "Migration Registration Reminder",
+  "description": "When a new migration file is created in backend/migrations/, reminds the agent to add it to the POSTGRES_MIGRATIONS array in run-all.js so the pipeline will execute it during deploy.",
+  "version": "1",
+  "when": {
+    "type": "fileCreated",
+    "patterns": [
+      "backend/migrations/*.js"
+    ]
+  },
+  "then": {
+    "type": "askAgent",
+    "prompt": "A new migration file was created. If this migration uses the Postgres pool (require('../db')), add its filename to the POSTGRES_MIGRATIONS array in backend/migrations/run-all.js so the CI/CD pipeline will run it automatically during deploy. Skip this if the file is run-all.js itself."
+  }
+}

.kiro/hooks/sqlite3-safety-check.kiro.hook

@@ -1,16 +0,0 @@
-{
-  "enabled": true,
-  "name": "SQLite3 Safety Check",
-  "description": "On save of files containing db.run, db.get, or db.all, verifies all sqlite3 calls use parameterized queries (? placeholders) instead of string concatenation, handle the error parameter first in every callback, and use hardcoded table/column names. Flags violations as inline comments prefixed with \"// FIXME:\".",
-  "version": "1",
-  "when": {
-    "type": "fileEdited",
-    "patterns": [
-      "backend/**/*.js"
-    ]
-  },
-  "then": {
-    "type": "askAgent",
-    "prompt": "The saved file may contain sqlite3 calls (db.run, db.get, or db.all). Scan the file and verify all sqlite3 calls follow these rules:\n\n1. Parameterized queries only: All SQL queries must use ? placeholders for dynamic values. Never use string concatenation or template literals to inject values into SQL strings.\n2. Error-first callbacks: Every callback passed to db.run, db.get, or db.all must handle the error parameter first (e.g., `if (err) { ... }`).\n3. Hardcoded table/column names: All table and column names in SQL strings must be hardcoded string literals, never sourced from variables or parameters.\n\nIf the file does not contain any db.run, db.get, or db.all calls, skip the check silently.\n\nFor any violations found, add an inline comment on the offending line prefixed with \"// FIXME:\" describing the specific issue. Do not modify any other code."
-  }
-}

.kiro/hooks/verify-migration-pattern.kiro.hook

@@ -1,16 +0,0 @@
-{
-  "enabled": true,
-  "name": "Verify Migration Pattern",
-  "description": "On save or create of migration files (migrate*.js), verifies the migration follows existing project patterns: uses CREATE TABLE IF NOT EXISTS, includes explicit column types, adds appropriate indexes, and wraps multiple statements in transactions. Compares against existing migrations for style consistency.",
-  "version": "1",
-  "when": {
-    "type": "fileEdited",
-    "patterns": [
-      "**/migrate*.js"
-    ]
-  },
-  "then": {
-    "type": "askAgent",
-    "prompt": "A migration file was just saved. Review the edited file and verify it follows the existing migration pattern used in this project. Check the existing migrations in backend/migrations/ for reference, then verify the edited file:\n\n1. Uses CREATE TABLE IF NOT EXISTS (not just CREATE TABLE)\n2. Includes all columns with explicit SQLite types (TEXT, INTEGER, REAL, etc.)\n3. Adds appropriate indexes for foreign keys and frequently queried columns\n4. Wraps operations in a serialized transaction (db.serialize + db.run(\"BEGIN TRANSACTION\") / COMMIT) if there are multiple statements\n5. Follows the same callback-based db.run() style as existing migrations\n6. Includes proper error handling\n\nCompare the file against the existing migrations in backend/migrations/ for style consistency. Report any deviations or issues found."
-  }
-}

.kiro/hooks/verify-migration-postgres.kiro.hook

@@ -0,0 +1,16 @@
+{
+  "enabled": true,
+  "name": "Verify Migration (PostgreSQL)",
+  "description": "When a migration file is created or edited in backend/migrations/, verifies it follows the project's PostgreSQL migration patterns: uses pool.query(), parameterized queries, IF NOT EXISTS, proper error handling, and matches the async/await style of existing migrations.",
+  "version": "1",
+  "when": {
+    "type": "fileCreated",
+    "patterns": [
+      "backend/migrations/*.js"
+    ]
+  },
+  "then": {
+    "type": "askAgent",
+    "prompt": "A migration file was just created or edited. Review it against the existing PostgreSQL migrations in backend/migrations/ and verify:\n\n1. Imports pool from '../db' (not sqlite3)\n2. Uses async/await with pool.query() (not callback-based db.run())\n3. Uses CREATE TABLE IF NOT EXISTS / ALTER TABLE with IF NOT EXISTS guards where possible\n4. Uses PostgreSQL types (TEXT, INTEGER, NUMERIC, TIMESTAMPTZ, BOOLEAN, JSONB) not SQLite types (REAL, DATETIME)\n5. Wraps multiple DDL statements in a transaction (BEGIN / COMMIT) via pool.query\n6. Adds appropriate indexes for foreign keys and frequently queried columns\n7. Includes try/catch error handling with process.exit(1) on failure\n8. Ends with pool.end() after completion\n9. Has a self-executing async main function pattern matching existing migrations\n\nCompare against recent migrations like add_vcl_reporting_columns.js or add_finding_archive_tables.js for style reference. Report any deviations."
+  }
+}

.kiro/hooks/verify-new-migration.kiro.hook

@@ -1,16 +0,0 @@
-{
-  "enabled": true,
-  "name": "Verify New Migration",
-  "description": "On creation of new migration files in backend/migrations/, verifies the migration follows existing project patterns: uses CREATE TABLE IF NOT EXISTS, includes explicit column types, adds appropriate indexes, and wraps multiple statements in transactions.",
-  "version": "1",
-  "when": {
-    "type": "fileCreated",
-    "patterns": [
-      "**/migrations/*.js"
-    ]
-  },
-  "then": {
-    "type": "askAgent",
-    "prompt": "A new migration file was just created. Review the file and verify it follows the existing migration pattern used in this project. Check the existing migrations in backend/migrations/ for reference, then verify the new file:\n\n1. Uses CREATE TABLE IF NOT EXISTS (not just CREATE TABLE)\n2. Includes all columns with explicit SQLite types (TEXT, INTEGER, REAL, etc.)\n3. Adds appropriate indexes for foreign keys and frequently queried columns\n4. Wraps operations in a serialized transaction (db.serialize + db.run(\"BEGIN TRANSACTION\") / COMMIT) if there are multiple statements\n5. Follows the same callback-based db.run() style as existing migrations\n6. Includes proper error handling\n\nCompare the file against the existing migrations in backend/migrations/ for style consistency. Report any deviations or issues found."
-  }
-}