Migration graph has 2 roots / 4 heads and wrong branch labels; CLAUDE.md says it is one linear chain #503

Tier 2: correctness of operator tooling and docs

Problem

alembic -c host/alembic.ini heads on main:

a7c2e91d4b58 (audit_log) (head)
e878882924e7 (api_tokens) (head)
f1a9c3d7b2e4 (tenants) (head)
f6a3b9d2e8c4 (keycloak) (head)

There are also two roots: 77162e7b184b_initial_schema and e36ab09c4a92_tenants_initial_schema. CLAUDE.md says "the history is one linear chain".

Labels are wrong or missing:

• Only 4 of 22 revisions set branch_labels.
• 51b2058d8afd_api_tokens_initial.py sits on the main trunk, so e878882924e7 (the background_tasks outbox) is reported as the api_tokens head. downgrade api_tokens@base would drop outbox tables.
• Keycloak's branch (168a2882f443) comes off a users revision (873ca2015033), so a Keycloak-only install still builds the users schema.
• users, file_storage, background_tasks, settings, permissions and feature_flags have no label.
• framework/hosting/simple_module_hosting/migrations.py:43,132 already handles several heads, so the code and the docs disagree.

Cost

The Doctor's per-module migration column is wrong or empty for most revisions, and operators following the docs get the wrong rollback model.

Fix

• Rewrite the CLAUDE.md and docs/database/migrations.md paragraphs to describe the real graph.
• Give unlabelled modules a label on their next revision.
• Add a test that pins the expected head count and asserts every head's label matches the module that owns its tables.