feat(db): Alembic migration for users table (async env, DATABASE_URL)

Adds alembic/ (async env.py driven by DATABASE_URL) and the 0001 users-table
migration matching the model. enabled now has a DB-level server_default of false
(secure default even for non-ORM inserts). Verified upgrade/downgrade on sqlite.

alembic/versions/0001_create_users.py

@@ -0,0 +1,38 @@
+"""create users table
+
+Revision ID: 0001
+Revises:
+Create Date: 2026-07-04
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0001"
+down_revision = None
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "users",
+        sa.Column("sub", sa.String(length=255), nullable=False),
+        sa.Column("email", sa.String(length=320), nullable=False),
+        sa.Column("name", sa.String(length=255), nullable=True),
+        sa.Column("athlete_id", sa.String(length=64), nullable=True),
+        sa.Column("api_key_enc", sa.LargeBinary(), nullable=True),
+        sa.Column("enabled", sa.Boolean(), server_default=sa.false(), nullable=False),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+        sa.Column(
+            "updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+        sa.Column("last_login_at", sa.DateTime(timezone=True), nullable=True),
+        sa.PrimaryKeyConstraint("sub"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("users")