fix(db): fail boot loudly on legacy single-tenant audit_log schema (#4919)

[yippietheproducer]

Fixes #4919.

Problem

A legacy single-tenant audit_log (pre multi-tenant rewrite) has no
community_id column, so every audit write errors with
column "community_id" does not exist while the relay keeps serving
traffic — a tamper-evident audit chain silently stops recording in
production, and the per-event ERROR line is easy to miss.

The legacy→multi-tenant cutover is deliberately an operator script
(scripts/cutover/1321_backfill_default_community.sql), not startup
migration state (see the stance in crates/buzz-db/src/migration.rs and
the discussion in the issue), so a 0028 migration was not the fix.

Fix

Adds reject_legacy_audit_log_shape() — a startup preflight that detects
the legacy shape and fails the boot loudly with the operator path,
instead of the silent per-event ERROR spam.

• Runs on both the migrating (run_migrations) and non-migrating
  (main.rs, BUZZ_AUTO_MIGRATE defaults to off) startup paths.
• The check is a live table-shape probe, not a _sqlx_migrations version
  check: affected deployments reached this state with no migration record
  of audit_log at all, so no version predicate would have caught them.
• Mirrors the existing reject_legacy_nip_rs_cardinality_ambiguity
  fail-closed preflight in the same file.

Verification

• cargo check -p buzz-db -p buzz-relay — clean, zero warnings
• New DB-backed regression test (fresh schema passes, legacy shape blocks
  with an actionable message naming community_id + the cutover path,
  absent table passes)
• Full buzz-db DB-backed suite: 152 passed / 2 failed — the 2 failures
  (relay_members owner-limit tests) are pre-existing, reproduced on the
  clean tree without this change