fix(backend): per-migration fallback tiers, truncating caps, tested retry

Three corrections to the earlier "survive un-migrated databases"
commit, all raised by independent verification agents.

── 1. A database missing ONLY migration 02 kept too little ──

The single fallback tier keyed on all six 20260821 columns, so a
database with migration 01 applied but not 02 (password_set_at) was
retried WITHOUT its five live onboarding columns: personalisation
read back empty and - worse - serializeProfile's legacy-exempt
default made genuinely new users report onboardingComplete: true and
skip onboarding. Postgres names the FIRST unknown column in a 42703,
so the two states are distinguishable: an 02-only gap names
password_set_at, an 01 gap names jurisdiction. There are now two
tiers, most-migrated first, with a regression test for the 02-only
shape asserting the live columns and NULL onboarding state survive.

── 2. The 200-character cap now truncates instead of rejecting ──

Rejection contradicted the signup trigger (handle_new_user applies
left(..., 200) silently) and would have permanently 400'd any
over-long value written before the cap existed - with the server's
detail string discarded by the settings UI, appearing as an
unexplained failure. Truncation matches the trigger exactly. The test
harness now records update payloads so the tests assert the actual
truncated write, not just a status code.

── 3. getUserModelSettings retry is now explicit and tested ──

The retry's second failure was silently swallowed (data stayed null
by accident); that fallback-to-defaults is now an explicit branch,
and the previously untested severe half of the un-migrated-DB bug -
saved models and legal_research_us=false surviving the retry - is
pinned by two new unit tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RuPCULDYgVsiCanRgbEy6W