feat: add two-App persistence foundation

[sabbour]

Summary

• Add two-App durable records, guarded persistence store, SQLite/PostgreSQL migrations and snapshots.
• Enforce project cascade, one-active Copilot binding, authorization claim and invocation uniqueness; use opaque credential references and immutable versions/digests only.
• Remove Key Vault post-write disk mirroring and make SQLite-to-PostgreSQL transfer transactional for the two-App record set.

Verification

• npm run validate:layer -- --area dotnet --dotnet-filter "FullyQualifiedName~TwoAppPersistenceStoreTests|FullyQualifiedName~TwoAppPersistencePostgresTests|FullyQualifiedName~DataMigratorTests|FullyQualifiedName~KeyVaultGitHubTokenStoreTests" (43 passed; 5 Postgres/Testcontainers tests skipped because Docker is unavailable)
• SQLite and PostgreSQL dotnet ef migrations has-pending-model-changes report no changes.

Closes #940

[sabbour]

Post-implementation review complete: code review initially identified SQLite source-schema compatibility, provider-FK parity, SQLite uniqueness classification, and PostgreSQL audit identity sequencing; all were fixed in 68ede03e and re-review reported no significant issues. Seraph security review and re-review reported no security findings. Focused layer validation passes (43 passed; 5 Postgres/Testcontainers tests skipped because Docker is unavailable).