feat(server): persist & backfill v1_hash on filters table

[mpecan]

Summary

Persists the schema-independent canonical TOML hash (v1_hash, ADR-0002) on the filters table and ships an operator-only backfill endpoint.

What changes

• Migration 20260428000000_add_v1_hash.sql: adds nullable v1_hash TEXT + non-partial index. Nullable on purpose — existing rows backfill operationally; NOT NULL and UNIQUE are deferred to the dedup PR.
• Publish computes v1 alongside content_hash in validate_and_prepare. Both publish paths (regular + stdlib) now store v1 on insert.
• v1-collision rejection: when a new submission has the same v1_hash as an existing row but a different content_hash, the request returns 200 OK with the existing row's author and content_hash, without inserting. Stops new publishes from re-splitting canonically equivalent filters across content_hash variants — the going-forward fix for [BUG] Community filters cannot be installed #350.
• Backfill endpoint POST /api/filters/backfill-v1-hashes: service-token-protected, scan-and-compute. Iterates WHERE v1_hash IS NULL rows, fetches the TOML from R2, computes v1, writes it back. Per-row failures (missing R2 object, malformed TOML) surface in failed[] without aborting the batch.

Out of scope (explicit follow-ups)

• Dedup migration for existing duplicate rows
• UNIQUE(v1_hash) constraint
• v1_hash NOT NULL tightening

These all belong to the next PR after backfill has been run in production. Per-row decisions for that work were captured during planning: canonical row = oldest, stdlib breaks ties; non-canonical rows kept and pointed at the canonical row via the existing successor_hash column (no URLs broken).

Operator runbook (for after deploy)

```sh
while true; do
out=$(curl -X POST -H "Authorization: Bearer $TOKF_SERVICE_TOKEN" \
$SERVER/api/filters/backfill-v1-hashes -d '{"limit":100}')
echo "$out"
[ "$(echo "$out" | jq .processed)" -eq 0 ] && break
done
```

Inspect any persistent entries in `failed[]` for manual triage (corrupt TOML in R2, missing object).

Test plan

• Migration applies cleanly to a fresh CockroachDB (`just db-reset && cargo sqlx migrate run --source crates/tokf-server/migrations`)
• Publish v1 storage + collision rejection (DB integration tests, fixture genuinely triggers v1-collision branch via `command = "x"` vs `["x"]`)
• Backfill: populates NULL rows, idempotent, respects limit, caps at MAX, requires service token, rejects invalid bearer, reports failure for missing R2 object, reports failure for unparseable TOML
• Stdlib publish stores v1 (separate INSERT path)
• `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo dupes` all clean
• Full server suite: 268 passed (was 266 before, +2 new tests)

Stack

• feat(common,server,cli): canonical v1 filter hash #353 ← (parent — `feat/350-canonical-v1`)
• fix(server,cli): server recomputes content_hash on download to absorb FilterConfig schema drift #351 (foundation — `feat/350-install-hash-back-compat`)
• main

This PR targets `feat/350-canonical-v1`. CI will run once #353 merges to main and this PR's base auto-rebases.

🤖 Generated with Claude Code