fix: all 5 high-severity bugs from codex review

- use sqlx migrate!() instead of broken split(';') — triggers now work
- seq via AUTOINCREMENT — no race conditions, monotonic ordering
- replace ?since= with ?after_seq= — cursor-based, no timestamp format issues
- replace all unwrap() with typed errors (404, 409, 400, 500)
- reply_to same-channel enforced in route handler
- add biome for frontend linting

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/colony-types/src/lib.rs

@@ -100,7 +100,7 @@ pub enum WsEvent {
 
 #[derive(Debug, Deserialize)]
 pub struct MessageQuery {
-    pub since: Option<DateTime<Utc>>,
+    pub after_seq: Option<i64>,
     pub r#type: Option<MessageType>,
     pub user_id: Option<Uuid>,
 }