[hkrlogic]

Part C of #44, stacked on #46. Retarget the base to main once #46 is merged.

Search already matched and ranked aliases exactly like labels, so this keeps one list: "phished" or "suspicious email" is now just a label.

Migration 026_aliases_into_labels.sql

• Appends each item's aliases to its labels, lower-cased, without duplicates and in first-seen order. This covers the working row and both published copies, with the version and review-by triggers paused so it does not count as a new publish.
• Drops the items_live view and recreates it without aliases (CREATE OR REPLACE cannot drop a column), then drops items.aliases.
• Nothing is cut: an item that ends up over the 20-label limit keeps every word, and its next edit asks for fewer.
• Upgrade-tested on a populated demo database. Incident Response went from labels runbook, security, phishing plus aliases phished, phishing, suspicious email to runbook, security, phishing, phished, suspicious email, with the published version unchanged.

Removed

• The aliases column, field and parsing: models, snapshots, writes, lookup, shelf search and the vocabulary.
• The Aliases form field and formAliases.
• The "Also searched as" line, the aliases: line in item output, the Markdown export line, and the "Aliases" row in "What changed".
• add_aliases and remove_aliases on suggest_labels. The tool stays, with add_labels, remove_labels, reason and expected_revision.

Tests

• item-aliases.test.ts is renamed to label-suggestions.test.ts and uses labels: search, typos, Review Lock and Unlock, Cancel, refusals.
• New tests check that suggest_labels has no alias params, plus a migration 026 test: merge into the working row and published copy, version unchanged, no aliases column on items or items_live, and the phished search still answers.
• The published-while-pending replay now re-runs only 018.
• Typecheck, lint and the full suite pass (423/423). One unrelated run hit the known flaky "permission denied to terminate process" teardown; a rerun was green.